CVE-2026-30077

OpenAirInterface V2.2.0 AMF crashes when it fails to decode the message. Not all decode failures result in a crash. But the crash is consistent for particular inputs. An example input in hex stream is 80 00 00 0E 00 00 01 00 0F 80 02 02 40 00 58 00 01 88.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://gitlab.eurecom.fr/oai/cn5g/oai-cn5g-amf/-/issues/76	Issue Tracking Third Party Advisory
https://gitlab.eurecom.fr/oai/cn5g/oai-cn5g-amf/-/merge_requests/414	Issue Tracking Mitigation

Configurations

Configuration 1 (hide)

cpe:2.3:a:openairinterface:openairinterface:2.2.0:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-03-30 18:16

Updated : 2026-06-17 10:32

NVD link : CVE-2026-30077

Mitre link : CVE-2026-30077

CVE.ORG link : CVE-2026-30077

JSON object : View

Products Affected

openairinterface

openairinterface

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2026-30077", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-30077", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-30T18:30:45.467369Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2026-03-30T18:16:18.660", "references": [{"url": "https://gitlab.eurecom.fr/oai/cn5g/oai-cn5g-amf/-/issues/76", "tags": ["Issue Tracking", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://gitlab.eurecom.fr/oai/cn5g/oai-cn5g-amf/-/merge_requests/414", "tags": ["Issue Tracking", "Mitigation"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "OpenAirInterface V2.2.0 AMF crashes when it fails to decode the message. Not all decode failures result in a crash. But the crash is consistent for particular inputs. An example input in hex stream is 80 00 00 0E 00 00 01 00 0F 80 02 02 40 00 58 00 01 88."}, {"lang": "es", "value": "OpenAirInterface V2.2.0 AMF se bloquea cuando no logra decodificar el mensaje. No todas las fallas de decodificaci\u00f3n resultan en un bloqueo. Pero el bloqueo es consistente para entradas particulares. Una entrada de ejemplo en flujo hexadecimal es 80 00 00 0E 00 00 01 00 0F 80 02 02 40 00 58 00 01 88."}], "lastModified": "2026-06-17T10:32:28.847", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:openairinterface:openairinterface:2.2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A4D4C2EA-57B3-42F2-9794-5DA2ADF51B23"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}