CVE-2026-7183: aligungr UERANSIM Radio Link Simulation Layer rls_pdu.cpp DecodeRlsMessage uncaught exception
A vulnerability has been found in aligungr UERANSIM up to 3.2.7. The affected element is the function rls::DecodeRlsMessage in the library src/lib/rls/rlspdu.cpp of the component Radio Link Simulation Layer. The manipulation of the argument pduLength leads to uncaught exception. The attack may be initiated remotely. Upgrading to version 3.2.8 is sufficient to fix this issue. The identifier of the patch is ca1a66fffe282767bb08618af9f848e3b68ea47b. It is suggested to upgrade the affected component. This behavior is related to CVE-2024-37877. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
aligungr UERANSIM (Radio Link Simulation Layer)to a version that resolves this vulnerability.Fixed in 3.2.8Patch ca1a66fffe282767bb08618af9f848e3b68ea47b - Compensating control
Since the issue can be initiated remotely, restrict network access to the UERANSIM Radio Link Simulation Layer service to reduce exposure until upgrading to 3.2.8 is completed.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-7183?
CVE-2026-7183 has a high severity due to the potential for uncaught exceptions in the Radio Link Simulation Layer.
How do I fix CVE-2026-7183?
To fix CVE-2026-7183, upgrade to a version of aligungr UERANSIM that is higher than 3.2.7.
What component is affected by CVE-2026-7183?
CVE-2026-7183 affects the Radio Link Simulation Layer in the rls_pdu.cpp source file.
In which versions of UERANSIM is CVE-2026-7183 found?
CVE-2026-7183 is found in aligungr UERANSIM versions up to and including 3.2.7.
What specific function is responsible for the vulnerability in CVE-2026-7183?
The vulnerability in CVE-2026-7183 is caused by the rls::DecodeRlsMessage function.