FlexRIC v2.0.0 contains a reachable assertion vulnerability in the e2ap_recv_sctp_msg() function located in src/lib/ep/e2ap_ep.c. The function allocates a fixed 32KB receive buffer and asserts that the return value from sctp_recvmsg() is less than the buffer length. A remote unauthenticated attacker can send an SCTP message with a payload size equal to or exceeding 32,768 bytes, causing the assertion to fail and crash the process with SIGABRT. This affects multiple SCTP endpoint types on ports 36421 and 36422. In release builds where assertions are stripped, a signed-to-unsigned integer overflow can occur, potentially leading to an out-of-bounds read. The vulnerability does not require a valid E2AP PDU to be exploited.

An attacker can remotely cause a denial of service by crashing critical FlexRIC components (near-RT RIC, iApp, E2 Agent, or xApp processes) through sending a specially crafted SCTP message. This results in process termination via SIGABRT, causing service disruption. There is no indication of confidentiality or integrity impact. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider network-level controls to restrict or monitor SCTP traffic on ports 36421 and 36422 to prevent reception of oversized SCTP messages. Avoid exposing these services to untrusted networks. No official fix or temporary workaround has been documented at this time.