CVE-2026-37221: FlexRIC v2

Synopsis

This is a denial-of-service vulnerability in FlexRIC v2.0.0, an open-source near-RT RAN Intelligent Controller. The flaw is reachable over the network with no authentication required, matching the CVSS vector (AV:N/PR:N). A remote attacker who sends a forged RIC_SUBSCRIPTION_RESPONSE message containing an unknown ric_id causes the process to crash via SIGABRT in Debug builds or a NULL pointer dereference (SIGSEGV) in Release builds, taking the near-RT RIC offline. No fix version has been published; HarborGuard tracks the upstream advisory and will surface a patched-image rebuild the moment one becomes available.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The near-RT RIC listens on port 36421 over the network; an attacker must be able to reach that port to deliver the forged RIC_SUBSCRIPTION_RESPONSE message.

• AuthenticationNot required

  The CVSS vector specifies PR:N, meaning no credentials or prior account access are needed to send the malicious message.

• Victim interactionNot required

  The CVSS vector specifies UI:N; the crash is triggered by the forged network message alone, with no action required from any user or operator.

• Attack complexityDetail

  The CVSS vector specifies AC:L, meaning the exploit is reliable and requires no special timing, race conditions, or environment-specific preconditions beyond network access.

Blast Radius

• Crashes the near-RT RIC process on the target host (SIGABRT in Debug builds, SIGSEGV in Release builds), terminating the controller.
• Takes the affected near-RT RIC offline, disrupting RAN resource management and any dependent O-RAN control loops for the duration of the outage.
• No confidentiality or integrity impact is indicated; the attacker gains no read or write access to data, only the ability to crash the service.