CVE-2026-9299
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
In the omec-project amf up to version 2.1.1, a vulnerability was found in the PDUSessionResourceModifyIndication function of the file /go/src/amf/ngap/handler.go that leads to memory corruption. The attack can be carried out remotely and the exploit has been published.
Risk Assessment
A remote attacker can cause memory corruption, potentially leading to service crashes, data leakage, or arbitrary code execution.
Recommendation
Apply the patch provided by the vendor to fix this vulnerability.
Other vulnerabilities in omec-project amf
See all- CVE-2026-14624Medium
A vulnerability was found in omec-project amf up to version 2.0.2/2.1.1 in the NGSetupRequest handler function within handler.go. Manipulation of this function allows a remote denial of service (DoS) attack.
- CVE-2026-14623Medium
A vulnerability was found in omec-project amf up to version 2.1.1 in the RRCInactiveTransitionReport function of the NGAP Message Handler. Remote manipulation can lead to denial of service (DoS). The exploit has been publicly disclosed and may be used.
- CVE-2026-9301Medium
In the omec-project amf up to version 2.1.1, a vulnerability was found in the NGReset Message Handler component that leads to memory corruption. The attack can be carried out remotely and the exploit has been published.
- CVE-2026-9300Medium
In the omec-project amf up to version 2.1.1, a vulnerability was found in the NGSetupRequest Handler component that leads to memory corruption. The attack can be carried out remotely and the exploit has been disclosed.
- CVE-2026-9298Medium
A vulnerability was found in the PathSwitchRequest Handler component of omec-project amf up to version 2.1.1, leading to memory corruption. The attack can be launched remotely and the exploit is publicly available.
Original NVD description (English source)
A flaw has been found in omec-project amf up to 2.1.1. Affected by this issue is the function PDUSessionResourceModifyIndication of the file /go/src/amf/ngap/handler.go. This manipulation causes memory corruption. Remote exploitation of the attack is possible. The exploit has been published and may be used. Applying a patch is the recommended action to fix this issue.