{"affected":[{"product":"n/a","source":"CNA: mitre","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"cveId":"CVE-2026-106808","cwes":["CWE-121"],"description":"OpenAirInterface Core Network v2.2.1 has a stack-based buffer overflow vulnerability in the OAI CN5G UDM Nudm_UEAU Generate Authentication Data endpoint. The UDM passes attacker-controlled resynchronizationInfo.rand and auts values to conv::hex_str_to_uint8(), which converts arbitrary-length hex strings into fixed-size stack buffers without validating the destination size. An unauthenticated attacker with access to the SBI interface and a valid SUPI can submit an oversized value to overwrite adjacent stack memory, corrupt the stack canary, and terminate the UDM process.","epss":null,"exploits":[{"kind":"exploit","source":"ADP: CISA-ADP","url":"https://github.com/openairinterface/oai-cn5g-udm/issues/4"}],"kev":null,"metrics":[{"score":7.5,"severity":"high","source":"ADP: CISA-ADP","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"}],"modifiedAt":1793646307660,"publishedAt":1793577600000,"references":[{"source":"CNA: mitre","tags":[],"url":"https://github.com/openairinterface/oai-cn5g-udm/issues/4"},{"source":"CNA: mitre","tags":[],"url":"https://gist.github.com/hackeryounow/66b7612729af8e205089097e68a42116"},{"source":"ADP: CISA-ADP","tags":["exploit"],"url":"https://github.com/openairinterface/oai-cn5g-udm/issues/4"}],"remediation":[],"revision":"636fe749aaa611b908317a5c90d0c98e53de523c80e0f7bf71fc2d10e87bb7f7","sources":[{"modifiedAt":1793646307660,"name":"CNA: mitre","retrievedAt":1793650167041,"url":"https://www.cve.org/CVERecord?id=CVE-2026-106808"}],"ssvc":{"assessedAt":1793646272283,"automatable":"yes","exploitation":"poc","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"CVE-2026-106808","updatedAt":1793650167041}