CVE-2026-37228

FlexRIC v2.0.0 contains a reachable assertion in e2ap_recv_sctp_msg() (src/lib/ep/e2ap_ep.c). The function allocates a fixed 32KB receive buffer and enforces assert(rc < len) on the sctp_recvmsg() return value. A remote unauthenticated attacker can send a single SCTP message with payload >= 32,768 bytes to crash the near-RT RIC, iApp, E2 Agent, or xApp process via SIGABRT. No valid E2AP PDU is required. All four SCTP endpoint types (ports 36421 and 36422) share this vulnerable code path. In Release builds (NDEBUG), the stripped assertion leads to a signed-to-unsigned integer overflow and potential out-of-bounds read.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/MinamiKotor1/oran-security-advisories-zhongnan-luo/blob/main/advisories/CVE-2026-37228.md	Exploit Mitigation Third Party Advisory
https://gitlab.eurecom.fr/mosaic5g/flexric	Product

Configurations

Configuration 1 (hide)

cpe:2.3:a:mosaic5g:flexric:2.0.0:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-06-01 19:16

Updated : 2026-07-22 07:10

NVD link : CVE-2026-37228

Mitre link : CVE-2026-37228

CVE.ORG link : CVE-2026-37228

JSON object : View

Products Affected

mosaic5g

flexric

CWE

CWE-617

Reachable Assertion

{"id": "CVE-2026-37228", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-37228", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-02T13:02:40.480543Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2026-06-01T19:16:33.187", "references": [{"url": "https://github.com/MinamiKotor1/oran-security-advisories-zhongnan-luo/blob/main/advisories/CVE-2026-37228.md", "tags": ["Exploit", "Mitigation", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://gitlab.eurecom.fr/mosaic5g/flexric", "tags": ["Product"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-617"}]}], "descriptions": [{"lang": "en", "value": "FlexRIC v2.0.0 contains a reachable assertion in e2ap_recv_sctp_msg() (src/lib/ep/e2ap_ep.c). The function allocates a fixed 32KB receive buffer and enforces assert(rc < len) on the sctp_recvmsg() return value. A remote unauthenticated attacker can send a single SCTP message with payload >= 32,768 bytes to crash the near-RT RIC, iApp, E2 Agent, or xApp process via SIGABRT. No valid E2AP PDU is required. All four SCTP endpoint types (ports 36421 and 36422) share this vulnerable code path. In Release builds (NDEBUG), the stripped assertion leads to a signed-to-unsigned integer overflow and potential out-of-bounds read."}, {"lang": "es", "value": "FlexRIC v2.0.0 contiene una aserci\u00f3n alcanzable en e2ap_recv_sctp_msg() (src/lib/ep/e2ap_ep.c). La funci\u00f3n asigna un b\u00fafer de recepci\u00f3n fijo de 32 KB y aplica assert(rc < len) en el valor de retorno de sctp_recvmsg(). Un atacante remoto no autenticado puede enviar un \u00fanico mensaje SCTP con una carga \u00fatil >= 32.768 bytes para bloquear el proceso near-RT RIC, iApp, E2 Agent o xApp a trav\u00e9s de SIGABRT. No se requiere una PDU E2AP v\u00e1lida. Los cuatro tipos de puntos finales SCTP (puertos 36421 y 36422) comparten esta ruta de c\u00f3digo vulnerable. En las compilaciones de lanzamiento (NDEBUG), la aserci\u00f3n eliminada conduce a un desbordamiento de entero con signo a sin signo y a una posible lectura fuera de l\u00edmites."}], "lastModified": "2026-07-22T07:10:00.107", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mosaic5g:flexric:2.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CFFCACEE-04A8-438A-A0BA-5C1D57943CF0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}