Read the docs
TI-2026-23442 Aliases CVE-2026-30075GHSA-wqfp-mq8w-2gx9

OpenAirInterface Version 2.2.0 has a Buffer Overflow vulnerability in processing…

Priority HIGH 72CWE-120Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-120 and the CVSS impact.

Summary

OpenAirInterface Version 2.2.0 has a Buffer Overflow vulnerability in processing UplinkNASTransport containing Authentication Response containing a NAS PDU with oversize response (For example 100 byte). The response is decoded by AMF and passed to the AUSF component for verification. AUSF crashes on receiving this oversize response. This can prohibit users from further registration and verification and can cause Denial of Services (DoS).

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00397 34th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:openairinterface:oai-cn5g-amf:2.2.0:*:*:*:*:*:*:*2.2.0VulnerableOpenairinterface
  • cpe:2.3:a:openairinterface:oai-cn5g-amf:2.2.0:*:*:*:*:*:*:* Versions 2.2.0 Vulnerable ·Openairinterface

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-30075
  2. 2026-10-03 Alias added: GHSA-wqfp-mq8w-2gx9
  3. 2026-10-07 EPSS moved to the 50th–90th percentile
  4. 2026-10-25 EPSS moved to the below the 50th percentile

References

Exploit 2

  • TI-2026-23446 OpenAirInterface v2.2.0 accepts Security Mode Complete without any integrity protection. CVSS 3.1HIGH 7.5
  • TI-2026-23444 OpenAirInterface V2.2.0 AMF crashes when it receives an NGAP message with invalid… CVSS 3.1HIGH 7.5
  • TI-2025-41054 OpenAirInterface CN5G AMF<=v2.0.1 There is a logical error when processing JSON format… CVSS 3.1HIGH 7.5
  • TI-2025-40453 OpenAirInterface CN5G AMF<=v2.1.9 has a buffer overflow vulnerability in processing NAS… CVSS 3.1HIGH 7.5
  • TI-2026-23445 In OpenAirInterface V2.2.0 AMF, Out of sequence messages causes incorrect state… CVSS 3.1CRITICAL 9.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences