CVE-2026-93307

2.1 lowEPSS 0.5%

Low (2.1). EPSS 0.5% chance of exploitation in the next 30 days.

A vulnerability has been found in O-RAN-SC SMO OAM 2025-06-10. Affected is an unknown function of the component VES Collector. Such manipulation of the argument additionalFields.padding leads to uncontrolled memory allocation. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through a bug report but has not responded yet.

Severity

CVSS 4.0

2.1 low

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P

CVSS 3.1

4.3 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 45% of CVEs (scores of 2026-10-31)
CWEs: CWE-400, CWE-789
Published: 2026-09-17
Modified: 2026-09-23
Record from: the NVD, synced 2026-10-19

References

https://gist.github.com/fklement/1c1ff92588944a021ceb2b5e894973c5
https://lf-o-ran-sc.atlassian.net/browse/SMO-201
https://vuldb.com/cve/CVE-2026-93307
https://vuldb.com/submit/942297
https://vuldb.com/submit/942306

Check your stack JSON