← Vulnerability feed

Vulnerability record · CVE-2026-37226 · published 1 June 2026

CVE-2026-37226: Mosaic5g flexric null pointer dereference vulnerability

MMosaic5g · Flexric

FlexRIC v2.0.0 crashes when the iApp receives an E42_RIC_SUBSCRIPTION_REQUEST referencing a non-existent E2 Node. The lookup function returns NULL, which is enforced by assert() in Debug builds (SIGABRT) and dereferenced in Release builds (SIGSEGV). A remote unauthenticated attacker can crash the iApp process (port 36422) by sending a subscription request with an arbitrary global_e2_node_id.

7.5 CVSS 3.1 High EPSS 0.64% · top 51.5% CWE-476 · NULL pointer dereference
7.5CVSS 3.1 base score
0.64%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References, 1 tagged exploit
22 Jul 2026Last modified by NVD

Description

FlexRIC v2.0.0 crashes when the iApp receives an E42_RIC_SUBSCRIPTION_REQUEST referencing a non-existent E2 Node. The lookup function returns NULL, which is enforced by assert() in Debug builds (SIGABRT) and dereferenced in Release builds (SIGSEGV). A remote unauthenticated attacker can crash the iApp process (port 36422) by sending a subscription request with an arbitrary global_e2_node_id.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/MinamiKotor1/oran-security-advisories-zhongnan-luo/blob/main/advisories/CVE-2026-37226.md ExploitMitigationThird Party Advisory
https://gitlab.eurecom.fr/mosaic5g/flexric Product

Track CVE-2026-37226 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.2CVE-2026-37234Mosaic5g flexric uncontrolled resource consumption vulnerabilityFlexRIC v2.0.0 allows a single SCTP connection to bind multiple xapp_ids by sending multiple E42_SETUP_REQUESTs. On disconnect, only the first regist…EPSS 0.53%7.5CVE-2026-37228Mosaic5g flexric vulnerabilityFlexRIC v2.0.0 contains a reachable assertion in e2ap_recv_sctp_msg() (src/lib/ep/e2ap_ep.c). The function allocates a fixed 32KB receive buffer and …EPSS 0.64%7.5CVE-2026-37229Mosaic5g flexric vulnerabilityFlexRIC v2.0.0 contains a reachable assertion in e2ap_create_pdu() triggered when ASN.1 PER decoding fails. A remote unauthenticated attacker can sen…EPSS 0.62%7.5CVE-2026-37230Mosaic5g flexric null pointer dereference vulnerabilityFlexRIC v2.0.0 crashes when the near-RT RIC receives a RIC_INDICATION message with a ran_func_id that does not exist in its registry. The lookup retu…EPSS 0.64%7.5CVE-2026-37231Mosaic5g flexric vulnerabilityFlexRIC v2.0.0 uses a uint16_t counter for xapp_id assignment but stores the value in uint32_t message fields. After 65,530+ E42_SETUP_REQUESTs, the …EPSS 0.61%7.5CVE-2026-37233Mosaic5g flexric vulnerabilityFlexRIC v2.0.0 contains an authorization bypass in the iApp's xApp isolation mechanism. The equality function eq_xapp_ric_gen_id() in src/ric/iApp/xa…EPSS 0.57%7.5CVE-2026-37235Mosaic5g flexric improper access control vulnerabilityFlexRIC v2.0.0 trusts the xapp_id field from E42 message payloads without binding it to the sender's SCTP association. The validation function valid_…EPSS 0.57%6.2CVE-2026-21525Windows Remote Access Connection Manager null pointer dereference DoSWindows Remote Access Connection Manager contains a null pointer dereference (CWE-476) that lets an unauthorized attacker deny service locally. The f…KEVEPSS 4.8%analysed

Source: NIST National Vulnerability Database (record CVE-2026-37226), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.