CVE-2025-65805 OpenAirInterface CVE debrief

Who should care

Network defenders and OpenAirInterface CN5G AMF administrators should assess exposure and prioritize remediation efforts. The vulnerability affects OpenAirInterface CN5G AMF version <= 2.1.9, and it is essential to review and update OpenAirInterface CN5G AMF to version > 2.1.9. Exposure assessment and version verification are necessary to determine the impact of the vulnerability.

Why it matters

CVE-2025-65805 is a high-severity buffer overflow vulnerability in OpenAirInterface CN5G AMF that requires prompt attention from network defenders and administrators.

• Denial-of-service attacks may occur via specially crafted NAS messages
• Potential code execution requires further verification
• Exposure assessment and version verification are necessary
• Remediation priority is high due to potential impact

Technical summary

OpenAirInterface CN5G AMF version <= 2.1.9 has a buffer overflow vulnerability in processing NAS messages, which can lead to denial-of-service and potential code execution. The vulnerability is caused by improper handling of NAS messages. Network defenders and OpenAirInterface CN5G AMF administrators should assess exposure and prioritize remediation efforts. The CVE record and NVD detail page provide information on the vulnerability, and it is essential to review and update OpenAirInterface CN5G AMF to version > 2.1.9.

Defensive priority

High priority for network defenders and OpenAirInterface CN5G AMF administrators.

Recommended defensive actions

• Review and update OpenAirInterface CN5G AMF to version > 2.1.9
• Restrict access to port N1
• Monitor for suspicious NAS messages
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD detail page provide information on the buffer overflow vulnerability in OpenAirInterface CN5G AMF. The vulnerability is caused by improper handling of NAS messages, which can lead to a denial-of-service attack and potentially allow for malicious code execution. The evidence is limited to the information provided in the CVE record and NVD detail page. Defenders should verify the affected scope, severity, and vendor guidance to assess exposure and prioritize remediation efforts.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.