CVE-2026-30078

CVE-2026-30078 is a denial-of-service vulnerability affecting OpenAirInterface V2.2.0 AMF (Access and Mobility Management Function) that causes the system to crash when receiving NGAP messages with invalid procedure codes or mismatched PDU types, such as messages sent as successfulOutcome when the specification requires InitiatingMessage. The vulnerability is rated as HIGH severity with a CVSS score of 7.5, reflecting a network-based attack vector that requires no authentication or user interaction and results in complete availability loss. The attack is relatively straightforward to execute given its low complexity, though the overall exploitation probability remains low as evidenced by the minimal EPSS score of 0.00061 and absence of the vulnerability from active exploit databases or KEV catalogs. Currently, there is no evidence of active exploitation, public exploit code availability, or significant community attention, indicating this remains a lower-priority threat despite its technical severity. Organizations running OpenAirInterface V2.2.0 should apply patches when available to prevent potential service disruptions.