NVD security advisoryHigh
High advisory for OpenAirInterface Core Network v2
CVE-2026-106808 · Reported 2 Nov 2026
Full advisory details, affected packages, severity context, and original source.
Affected technology
OpenAirInterface Core Network v2Affected product
Advisory overview
OpenAirInterface Core Network v2.2.1 has a stack-based buffer overflow vulnerability in the OAI CN5G UDM Nudm_UEAU Generate Authentication Data endpoint. The UDM passes attacker-controlled resynchronizationInfo.rand and auts values to conv::hex_str_to_uint8(), which converts arbitrary-length hex strings into fixed-size stack buffers without validating the destination size. An unauthenticated attacker with access to the SBI interface and a valid SUPI can submit an oversized value to overwrite adjacent stack memory, corrupt the stack canary, and terminate the UDM process.