The vulnerability in FlexRIC v2.0.0 arises from the e2ap_recv_sctp_msg() function allocating a fixed 32KB receive buffer and asserting that the received message length is less than this buffer size. An attacker can send a single SCTP message with a payload equal to or exceeding 32,768 bytes, triggering the assertion and causing the process to abort (SIGABRT). In release builds where assertions are stripped, this leads to a signed-to-unsigned integer overflow and a potential out-of-bounds read, which may cause undefined behavior or crashes. This affects the near-RT RIC, iApp, E2 Agent, and xApp processes, and all four SCTP endpoint types on ports 36421 and 36422 share this vulnerable code path. No authentication or valid protocol data unit is required for exploitation.

A remote unauthenticated attacker can cause a denial of service by crashing critical FlexRIC components (near-RT RIC, iApp, E2 Agent, xApp) through a crafted SCTP message. This disrupts the availability of these processes. There is also a potential memory safety issue in release builds due to an integer overflow and out-of-bounds read, which could lead to undefined behavior or further instability. No information is provided about code execution or data disclosure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting or monitoring SCTP traffic on ports 36421 and 36422 to trusted sources to reduce exposure. No official fix or workaround information is provided in the available data.