CVE-2026-106808: Buffer Overflow
OpenAirInterface Core Network v2.2.1 has a stack-based buffer overflow vulnerability in the OAI CN5G UDM NudmUEAU Generate Authentication Data endpoint. The UDM passes attacker-controlled resynchronizationInfo.rand and auts values to conv::hexstrtouint8(), which converts arbitrary-length hex strings into fixed-size stack buffers without validating the destination size. An unauthenticated attacker with access to the SBI interface and a valid SUPI can submit an oversized value to overwrite adjacent stack memory, corrupt the stack canary, and terminate the UDM process.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments running OpenAirInterface Core Network v2.2.1 are exposed if an attacker can reach the UDM's SBI interface and knows a valid SUPI. The attack does not require authentication or user interaction.
What is the practical impact of successful exploitation?
An attacker can provide oversized hexadecimal resynchronizationInfo.rand or auts values to corrupt stack memory and the stack canary. The described result is termination of the UDM process, causing a denial of service.
Are default deployments affected?
The available information does not establish whether the SBI interface is exposed in a default deployment. Exposure depends on whether an attacker can access that interface and has a valid SUPI.
What can be done before a fix is available?
Restrict access to the UDM SBI interface to trusted network components and prevent untrusted parties from submitting requests to the Generate Authentication Data endpoint. Limiting access reduces the ability to meet the stated exploitation prerequisites.