Read the docs
TI-2026-07345 Aliases CVE-2026-8349GHSA-3h63-fx68-x5fm

omec-project amf NGAP Message memory corruption

Priority MEDIUM 57CWE-119Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · None · Low
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

A flaw has been found in omec-project amf up to 2.1.1. This vulnerability affects unknown code of the component NGAP Message Handler. Executing a manipulation can lead to memory corruption. The attack can be launched remotely. The exploit has been published and may be used. This patch is called 8a4c33cdda866094f1989bdeff6d8642fce8de8435f89defd66831c97715f5aa. It is best practice to apply a patch to resolve this issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00309 23rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
omec-projectamf2.1.0; 2.1.1—No fix listedCNA
—github.com/omec-project/amf (Go)up to 1.7.0—No fix listedGHSA-3h63-fx68-x5fm
  • amf Vendoromec-project Affected 2.1.0; 2.1.1 Fixed in — No fix listed CNA
  • github.com/omec-project/amf (Go) Vendor— Affected up to 1.7.0 Fixed in — No fix listed GHSA-3h63-fx68-x5fm

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-8349
  2. 2026-10-03 Alias added: GHSA-3h63-fx68-x5fm

References

Exploit 1

Patch 2

Advisory 1

Other 2

  • TI-2026-07720 omec-project amf NGAP Message handler.go null pointer dereference CVSS 4.0MEDIUM 5.3
  • TI-2025-13834 NULL pointer dereference in omec-project UPF CVSS 4.0MEDIUM 5.3
  • TI-2026-12321 omec-project amf NGSetupRequest handler.go denial of service CVSS 4.0MEDIUM 5.3
  • TI-2026-12320 omec-project amf NGAP Message RRCInactiveTransitionReport denial of service CVSS 4.0MEDIUM 5.3
  • TI-2026-08167 omec-project amf NGReset Message memory corruption CVSS 4.0MEDIUM 5.3
  • TI-2026-08166 omec-project amf NGSetupRequest memory corruption CVSS 4.0MEDIUM 5.3
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences