CVE-2026-37226

Katalog CVE

CVSS 7.5 · High EPSS 0,64%

Kerentanan NULL Pointer Dereference pada mosaic5g flexric. Skor CVSS 3.1 7.5 (High) menurut CISA ADP.

Deskripsi (NVD)

FlexRIC v2.0.0 crashes when the iApp receives an E42_RIC_SUBSCRIPTION_REQUEST referencing a non-existent E2 Node. The lookup function returns NULL, which is enforced by assert() in Debug builds (SIGABRT) and dereferenced in Release builds (SIGSEGV). A remote unauthenticated attacker can crash the iApp process (port 36422) by sending a subscription request with an arbitrary global_e2_node_id.

Rincian

Terbit di NVD

1 Juni 2026

Terakhir diubah

22 Juli 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-476: NULL Pointer Dereference

EPSS (30 hari)

0,64% peluang dieksploitasi; lebih tinggi dari 49,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/MinamiKotor1/oran-security-advisories-zhongnan-luo/blob/main/advisories/CVE-2026-37226.md exploit · mitigasi · advisory pihak ketiga
• https://gitlab.eurecom.fr/mosaic5g/flexric product