CVE-2026-93307: O-RAN-SC SMO OAM VES Collector memory allocation

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-17 · updated 2026-09-23
Weakness: CWE-400

Description

A vulnerability has been found in O-RAN-SC SMO OAM 2025-06-10. Affected is an unknown function of the component VES Collector. Such manipulation of the argument additionalFields.padding leads to uncontrolled memory allocation. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through a bug report but has not responded yet.

Affected products

O-RAN-SC SMO OAM: 2025-06-10

References

https://gist.github.com/fklement/1c1ff92588944a021ceb2b5e894973c5
https://lf-o-ran-sc.atlassian.net/browse/SMO-201
https://vuldb.com/cve/CVE-2026-93307
https://vuldb.com/submit/942297
https://vuldb.com/submit/942306
https://vuldb.com/vuln/406593
https://vuldb.com/vuln/406593/cti
https://lf-o-ran-sc.atlassian.net/browse/SMO-201
https://vuldb.com/submit/942297
https://vuldb.com/submit/942306

Get alerted when CVE-2026-93307 or the next vulnerability affects your stack