Quick answers
- Is CVE-2026-117068 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-117068 being exploited in the wild.
- How severe is CVE-2026-117068?
- Informational severity, published 2 November 2026.
- Which products and versions are affected?
- Openairinterface CN5G AMF v2.2.1.
- Is there a fix for CVE-2026-117068?
- A patch was published on 2026-10-13: Fix merged into develop branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-117068 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-117068?
- Check whether you run Openairinterface CN5G AMF at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An integer underflow in the DecodeSuci() function fails to validate the length of the SUCI field within the 5GS Mobile Identity IE, causing an out-of-bounds heap read when processing truncated NAS Registration Request messages. An unauthenticated remote attacker can trigger this vulnerability over the network by sending a crafted message containing a malformed SUCI, resulting in AMF process crash. The fix was merged into the develop branch in October 2026.
Affected products
- OpenAirInterface CN5G AMF v2.2.1
Timeline
- 2026-11-02: disclosed
- 2026-10-13: patched: Fix merged into develop branch