Executive brief
A vulnerability exists in the OpenAirInterface5G software, which is used to run 5G cellular base stations. An attacker can remotely crash the base station software by sending a high volume of specific requests, leading to a complete loss of 5G service for all connected mobile users. This attack does not require any special permissions or authentication to execute.
Technical details
A divide-by-zero vulnerability (CWE-369) exists in the E2SM-KPM RAN Function within OpenAirInterface5G 2.4.0. Specifically, the functions fill_RRU_PrbTotDl() and fill_RRU_PrbTotUl() in ran_func_kpm_subs.c calculate PRB usage percentages by dividing by the difference between two consecutive total_prb_aggregate samples without verifying if the divisor is zero. An unauthenticated attacker can send a high volume of E42_RIC_SUBSCRIPTION_REQUESTs via the FlexRIC iApp (SCTP port 36422), forcing high-frequency KPM Indication reports. If consecutive sampling intervals yield identical PRB aggregate values, the resulting zero divisor triggers a SIGFPE, crashing the nr-softmodem process and causing a denial of service for the 5G cell. No official patch was available at the time of reporting.
Affected products
- OpenAirInterface Software Alliance OpenAirInterface5G nr-softmodem 2.4.0
Timeline
- 2026-06-01: disclosed
- 2026-06-01: advisory