PT-2026-45511 · Undefined · Undefined

Minamikotor1 + 1 · Published 2026-06-01 · Updated 2026-06-01 · CVE-2026-37232

Mitre

An issue was discovered in OpenAirInterface5G 2.4.0 (nr-softmodem) in the E2SM-KPM RAN Function's PRB utilization metric calculation. The functions fill RRU PrbTotDl() and fill RRU PrbTotUl() in openair2/E2AP/RAN FUNCTION/O-RAN/ran func kpm subs.c (lines 182 and 197) compute PRB usage percentages by dividing by the difference of two consecutive total prb aggregate samples without checking for zero. When a malicious xApp sends a high volume of E42 RIC SUBSCRIPTION REQUESTs via the FlexRIC iApp (port 36422/SCTP), the E2 Agent generates KPM Indication reports at high frequency. If two consecutive sampling intervals yield identical PRB aggregate values, the divisor becomes zero, triggering SIGFPE and crashing the entire 5G base station process (nr-softmodem). This results in complete 5G cell service interruption for all connected UEs. No authentication is required.

Exploit

Related Identifiers

CVE-2026-37232

Affected Products

Undefined

References · 3

• 🔥 https://github.com/MinamiKotor1/oran-security-advisories-zhongnan-luo/blob/main/advisories/CVE-2026-37232.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-37232 · Security Note
• https://gitlab.eurecom.fr/oai/openairinterface5g · Note