CVE-2026-37226: FlexRIC v2

Synopsis

A NULL pointer dereference in FlexRIC v2.0.0 allows a remote unauthenticated attacker to crash the iApp process. The vulnerability is reachable over the network on port 36422 with no authentication required, by sending a crafted E42_RIC_SUBSCRIPTION_REQUEST message referencing a non-existent E2 Node. Successful exploitation terminates the iApp process, causing a full denial of service for the affected O-RAN near-real-time RIC component. HarborGuard is tracking the advisory for patch availability, as no fix version has been published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the iApp service over the network; the vulnerable endpoint listens on TCP port 36422 and is exposed to any network-reachable client.

• AuthenticationNot required

  No credentials or session are needed; the malicious subscription request can be sent by any unauthenticated client.

• Victim interactionNot required

  No user or operator action is required; the attacker sends the crafted packet directly and the crash occurs automatically.

• Attack complexityDetail

  Exploit is reliable and condition-free; crafting an E42_RIC_SUBSCRIPTION_REQUEST with an arbitrary global_e2_node_id value is sufficient to trigger the NULL dereference on every attempt.

Blast Radius

• Crashes the iApp process via SIGABRT (Debug builds) or SIGSEGV (Release builds), immediately terminating the near-real-time RIC component.
• Drops all active E2 Node subscriptions managed by the iApp, disrupting RAN control-loop functions that depend on those subscriptions.
• Causes a sustained denial of service as long as the attacker continues sending crafted messages after each restart.