PT-2026-45507 · Undefined · Undefined

Minamikotor1 · Publicado 2026-06-01 · Atualizado 2026-06-01 · CVE-2026-37228

Mitre

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

FlexRIC v2.0.0 contains a reachable assertion in e2ap recv sctp msg() (src/lib/ep/e2ap ep.c). The function allocates a fixed 32KB receive buffer and enforces assert(rc < len) on the sctp recvmsg() return value. A remote unauthenticated attacker can send a single SCTP message with payload >= 32,768 bytes to crash the near-RT RIC, iApp, E2 Agent, or xApp process via SIGABRT. No valid E2AP PDU is required. All four SCTP endpoint types (ports 36421 and 36422) share this vulnerable code path. In Release builds (NDEBUG), the stripped assertion leads to a signed-to-unsigned integer overflow and potential out-of-bounds read.

Exploit

Correção

Assertion Failure

Enumeração de Fraquezas

CWE-617

Identificadores relacionados

CVE-2026-37228

Produtos afetados

Undefined

Referências · 3

• 🔥 https://github.com/MinamiKotor1/oran-security-advisories-zhongnan-luo/blob/main/advisories/CVE-2026-37228.md · Exploit
• https://gitlab.eurecom.fr/mosaic5g/flexric · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-37228 · Nota de Segurança