# CVE-2026-117069: OpenAirInterface CN5G AMF integer truncation in NAS decoder

Source: https://junglewise.ai/threats/cve-2026-117069-an-integer-truncation-vulnerability-in-the-nas-decoder-of  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-02. Updated: 2026-11-02  
License: CC BY 4.0 with a link back

CVE-2026-117069 · Severity: info · Published 2026-11-02

OpenAirInterface CN5G AMF is a 5G network component that processes authentication and mobility management messages from mobile devices. An integer truncation vulnerability in its NAS message decoder allows an unauthenticated attacker to crash the AMF service by sending crafted 5G registration requests, disrupting telecommunications service for all users relying on that AMF instance.

Technologies: [Openairinterface CN5G AMF](https://junglewise.ai/threats/technologies/cn5g-amf). Vendors: [Openairinterface](https://junglewise.ai/threats/vendors/openairinterface).

## Quick answers

**Is CVE-2026-117069 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-117069 being exploited in the wild.

**How severe is CVE-2026-117069?** Informational severity, published 2 November 2026.

**Which products and versions are affected?** Openairinterface CN5G AMF v2.2.1.

**Is there a fix for CVE-2026-117069?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-117069 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-117069?** Check whether you run Openairinterface CN5G AMF at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Type6NasIe::Validate() function truncates a 32-bit length value to 16 bits, allowing malformed length fields in 5GS Mobile Identity information elements to bypass the only validation gate. When processing a crafted NAS Registration Request with a malformed IMEISV identity type, the DecodeImeisv() function performs an unbounded out-of-bounds heap read, crashing the AMF process. An unauthenticated remote attacker can trigger this via NGAP/SCTP without valid credentials, SIM card, or prior authentication.

## Affected products

- OpenAirInterface CN5G AMF v2.2.1

## Timeline

- 2026-09-19: disclosed: Bug reported on GitHub
- 2026-11-02: advisory

## References

- [https://gist.github.com/hackeryounow/1c6741be7d536bd98434ac270dbb1f60](https://gist.github.com/hackeryounow/1c6741be7d536bd98434ac270dbb1f60)
- [https://github.com/openairinterface/oai-cn5g-amf/issues/16](https://github.com/openairinterface/oai-cn5g-amf/issues/16)

## Related threats

- [OpenAirInterface CN5G AMF integer underflow in NAS decoder](https://junglewise.ai/threats/cve-2026-117068-an-integer-underflow-vulnerability-in-the-nas-decoder-of)
- [OpenAirInterface CN5G AMF out-of-bounds memory access in SCTP](https://junglewise.ai/threats/cve-2026-117067-an-out-of-bounds-memory-access-vulnerability-in-the-n2-sctp)