CVE-2026-10565
LowCVSS 3.1Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
A race condition vulnerability was discovered in Open5GS up to version 2.7.6 in the gmm_state_security_mode function of src/amf/gmm-sm.c in the NGAP Handover component. The attack is remote but requires high complexity.
Risk Assessment
The vulnerability could allow an attacker to disrupt the authentication process during handover, potentially leading to unauthorized network access.
Recommendation
Monitor the pull request for the fix and apply it once accepted. In the meantime, monitor network traffic for anomalies.
Original NVD description (English source)
A security flaw has been discovered in Open5GS up to 2.7.6. The impacted element is the function gmm_state_security_mode of the file src/amf/gmm-sm.c of the component NGAP Handover. Performing a manipulation results in race condition. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitability is regarded as difficult. The exploit has been released to the public and may be used for attacks. The pull request to fix this issue awaits acceptance.