CVE-2026-37221

Name of the Vulnerable Software and Affected Versions FlexRIC version 2.0.0

Description The software crashes when it receives a RIC SUBSCRIPTION RESPONSE containing an unknown ric id that lacks a corresponding pending event. The near-RT RIC employs the assert() function to verify the existence of a pending event during response processing. A remote unauthenticated attacker can send a forged RIC SUBSCRIPTION RESPONSE to the near-RT RIC on port 36421, resulting in a SIGABRT (abnormal termination) in Debug builds or a NULL pointer dereference (SIGSEGV), which occurs when a program attempts to access a memory location that is not mapped, in Release builds.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.