# CVE-2026-117068: OpenAirInterface CN5G AMF integer underflow in NAS decoder

Source: https://junglewise.ai/threats/cve-2026-117068-an-integer-underflow-vulnerability-in-the-nas-decoder-of  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-02. Updated: 2026-11-02  
License: CC BY 4.0 with a link back

CVE-2026-117068 · Severity: info · Published 2026-11-02

OpenAirInterface CN5G AMF is a 5G core network function that handles mobile device registration. An integer underflow vulnerability in its NAS message decoder allows an unauthenticated attacker to crash the AMF service by sending malformed registration requests, causing a denial of service to all connected 5G devices.

Technologies: [Openairinterface CN5G AMF](https://junglewise.ai/threats/technologies/cn5g-amf). Vendors: [Openairinterface](https://junglewise.ai/threats/vendors/openairinterface).

## Quick answers

**Is CVE-2026-117068 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-117068 being exploited in the wild.

**How severe is CVE-2026-117068?** Informational severity, published 2 November 2026.

**Which products and versions are affected?** Openairinterface CN5G AMF v2.2.1.

**Is there a fix for CVE-2026-117068?** A patch was published on 2026-10-13: Fix merged into develop branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-117068 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-117068?** Check whether you run Openairinterface CN5G AMF at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An integer underflow in the DecodeSuci() function fails to validate the length of the SUCI field within the 5GS Mobile Identity IE, causing an out-of-bounds heap read when processing truncated NAS Registration Request messages. An unauthenticated remote attacker can trigger this vulnerability over the network by sending a crafted message containing a malformed SUCI, resulting in AMF process crash. The fix was merged into the develop branch in October 2026.

## Affected products

- OpenAirInterface CN5G AMF v2.2.1

## Timeline

- 2026-11-02: disclosed
- 2026-10-13: patched: Fix merged into develop branch

## References

- [https://gist.github.com/hackeryounow/aa1df06bb785bda0952a30939dcb9a76](https://gist.github.com/hackeryounow/aa1df06bb785bda0952a30939dcb9a76)
- [https://github.com/openairinterface/oai-cn5g-amf/pull/26/commits/c5178c644f87c5ef8828353192fea464d977e17b](https://github.com/openairinterface/oai-cn5g-amf/pull/26/commits/c5178c644f87c5ef8828353192fea464d977e17b)

## Related threats

- [OpenAirInterface CN5G AMF integer truncation in NAS decoder](https://junglewise.ai/threats/cve-2026-117069-an-integer-truncation-vulnerability-in-the-nas-decoder-of)
- [OpenAirInterface CN5G AMF out-of-bounds memory access in SCTP](https://junglewise.ai/threats/cve-2026-117067-an-out-of-bounds-memory-access-vulnerability-in-the-n2-sctp)