PatchSiren cyber security CVE debrief
CVE-2026-9301 omec-project CVE debrief
A memory corruption vulnerability exists in the omec-project AMF (Access and Mobility Management Function) software, affecting versions up to 2.1.1. The flaw resides in the NGReset message handler component, where improper input validation allows remote attackers to trigger memory corruption through crafted NGReset messages. The vulnerability has been publicly disclosed with proof-of-concept availability, though its CVSS 4.0 score of 2.1 reflects limited impact due to required privileges and low confidentiality, integrity, and availability impacts. The issue was reported to VulDB on May 23, 2026, with subsequent modification on May 26, 2026. A fix has been proposed via pull request.
- Vendor
- omec-project
- Product
- amf
- CVSS
- LOW 2.1
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-23
- Original CVE updated
- 2026-05-26
- Advisory published
- 2026-05-23
- Advisory updated
- 2026-05-26
Who should care
Telecommunications operators deploying open source 5G core networks; security teams managing private 5G infrastructure; DevOps engineers maintaining omec-project AMF deployments; network architects designing 5G security boundaries
Technical summary
The vulnerability exists in the NGReset message handler of the omec-project AMF implementation. The AMF is a critical 5G core network function responsible for access and mobility management. NGReset is an NG Application Protocol (NGAP) message used to reset the NG interface between the AMF and gNodeB. Improper bounds checking during NGReset message parsing leads to memory corruption. The attack requires network access to the AMF's NGAP interface and valid low-privilege credentials or context. Successful exploitation could result in limited impacts to confidentiality, integrity, and availability of the AMF function. The CVSS 4.0 score of 2.1 (LOW severity) reflects these constrained impact metrics despite the network attack vector and public exploit availability.
Defensive priority
LOW
Recommended defensive actions
- Upgrade omec-project AMF to a version containing the fix from pull request 666
- Monitor NGReset message handling for anomalous patterns in 5G core network traffic
- Apply principle of least privilege for AMF administrative access
- Review memory safety practices in NGAP message parsing code
- Subscribe to omec-project security advisories for patch availability notifications
Evidence notes
The vulnerability is classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). The CVSS 4.0 vector indicates network attack vector with low attack complexity, no user interaction required, but low privileges required (PR:L). The exploit is confirmed publicly available (E:P). Source references include the omec-project AMF GitHub repository, issue #678 tracking the vulnerability, and pull request #666 containing the proposed fix.
Official resources
Public disclosure occurred on May 23, 2026, with exploit availability confirmed. The vulnerability was assigned CVE-2026-9301 and entered a Deferred status in NVD as of the May 26, 2026 modification.