CVE-2026-37226

Name of the Vulnerable Software and Affected Versions FlexRIC version 2.0.0

Description A remote unauthenticated attacker can cause the iApp process on port 36422 to crash by sending an E42 RIC SUBSCRIPTION REQUEST that references a non-existent E2 Node. This occurs because the lookup function returns NULL, leading to a SIGABRT in Debug builds due to an assert() or a SIGSEGV in Release builds due to a null pointer dereference. The attack is triggered by providing an arbitrary global e2 node id.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.