# CVE-2026-117067: OpenAirInterface CN5G AMF out-of-bounds memory access in SCTP

Source: https://junglewise.ai/threats/cve-2026-117067-an-out-of-bounds-memory-access-vulnerability-in-the-n2-sctp  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-02. Updated: 2026-11-02  
License: CC BY 4.0 with a link back

CVE-2026-117067 · Severity: info · Published 2026-11-02

OpenAirInterface CN5G AMF is core network software that manages 5G mobile subscriber connections. An unauthenticated attacker on the network can crash the AMF process by repeatedly establishing SCTP connections, exploiting improper file descriptor bounds checking. This denial of service can disrupt mobile network service availability.

Technologies: [Openairinterface CN5G AMF](https://junglewise.ai/threats/technologies/cn5g-amf). Vendors: [Openairinterface](https://junglewise.ai/threats/vendors/openairinterface).

## Quick answers

**Is CVE-2026-117067 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-117067 being exploited in the wild.

**How severe is CVE-2026-117067?** Informational severity, published 2 November 2026.

**Which products and versions are affected?** Openairinterface CN5G AMF v2.2.1.

**Is there a fix for CVE-2026-117067?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-117067 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-117067?** Check whether you run Openairinterface CN5G AMF at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an out-of-bounds memory access in the N2 SCTP interface caused by insufficient bounds checking before FD_SET() operations. An unauthenticated remote attacker can repeatedly establish SCTP associations, causing file descriptor values to exceed the fd_set structure bounds and triggering process termination. The attack requires network access to the SCTP interface with no authentication required.

## Affected products

- OpenAirInterface CN5G AMF v2.2.1

## Timeline

- 2026-11-02: disclosed

## References

- [https://gist.github.com/hackeryounow/87ecc801e93860fb41a220090f99f4d7](https://gist.github.com/hackeryounow/87ecc801e93860fb41a220090f99f4d7)
- [https://github.com/openairinterface/oai-cn5g-amf/issues/14](https://github.com/openairinterface/oai-cn5g-amf/issues/14)

## Related threats

- [OpenAirInterface CN5G AMF integer truncation in NAS decoder](https://junglewise.ai/threats/cve-2026-117069-an-integer-truncation-vulnerability-in-the-nas-decoder-of)
- [OpenAirInterface CN5G AMF integer underflow in NAS decoder](https://junglewise.ai/threats/cve-2026-117068-an-integer-underflow-vulnerability-in-the-nas-decoder-of)