PatchSiren

Eurecom CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

Review Eurecom CVE published 2026-06-01

CVE-2026-37221

A remote unauthenticated attacker can crash the FlexRIC near-RT RIC by sending a forged RIC_SUBSCRIPTION_RESPONSE containing an unknown ric_id with no matching pending event. In Debug builds, the crash manifests as SIGABRT due to an assert() failure; in Release builds, it manifests as a NULL pointer dereference (SIGSEGV). The vulnerability exists because the response handler uses assert() to enforce the p [truncated]