Vulnerability in Mosaic5g Flexric
CVE-2026-37228
FlexRIC v2.0.0 contains a reachable assertion in e2ap_recv_sctp_msg() (src/lib/ep/e2ap_ep.c). The function allocates a fixed 32KB receive buffer and enforces assert(rc < len) on the sctp_recvmsg() return value. A remote unauthenticated attacker can send a single SCTP message with payload >= 32,768 bytes to crash the near-RT RIC, iApp, E2 Agent, or xApp process via SIGABRT. No valid E2AP PDU is required. All four SCTP endpoint types (ports 36421 and 36422) share this vulnerable code path. In Release builds (NDEBUG), the stripped assertion leads to a signed-to-unsigned integer overflow and potential out-of-bounds read.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.006 (48.6th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 49th percentile — 48.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.006 · newest: 0.006 · change: -0.000
Affected products
- Mosaic5g Flexric — versions 2.0.0
Weakness classification (CWE)
References
- gitlab.eurecom.fr/mosaic5g/flexric (Product)
- github.com/MinamiKotor1/oran-security-advisories-zhongnan-luo/blob/main/advisor… (Exploit, Third Party Advisory, Mitigation)
Frequently asked questions
- What is CVE-2026-37228?
- CVE-2026-37228 is a high-severity vulnerability in Mosaic5g Flexric, classified under Reachable Assertion. CVSS score: 7.5/10. Published 2026-06-01.
- How severe is CVE-2026-37228?
- High severity. CVSS v3 base score is 7.5 out of 10.