CVE-2026-78156
HighCVSS 7.4Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
A security vulnerability was detected in Open5GS 2.8.0 in the hss_ogs_diam_s6a_air_cb function of src/hss/hss-s6a-path.c in the S6a Authentication-Information-Request Handler component. Manipulation of the Visited-PLMN-Id argument leads to a heap-based buffer overflow. The attack may be performed remotely.
Risk Assessment
A remote attack can cause a buffer overflow, potentially allowing arbitrary code execution or system crash. The organization is at risk of severe security compromise.
Recommendation
Apply the patch named a9c82ee0b590d76a581b0580cb46b598984e2392 to remediate the vulnerability.
Other vulnerabilities in Open5GS
See all- CVE-2026-30045Unknown
An integer overflow in the /nnrf-disc/v1/nf-instances component of open5gs v2.7.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted HTTP/2 GET request.
- CVE-2026-37198High
An integer overflow in the SMF component of Open5GS v2.7.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted GTP packet.
- CVE-2026-30047High
A reachable assertion vulnerability in the /nsmf-pdusession/v1/sm-contexts component of Open5GS v2.7.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted DELETE request.
- CVE-2026-30046High
A reachable assertion vulnerability in the NUDM-UECM interface of Open5GS v2.7.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted DELETE request.
- CVE-2026-78186Medium
A flaw was found in Open5GS up to version 2.8.0 in an unknown function of src/hss/hss-cx-path.c in the HSS component. Manipulation of the User-Name argument causes a reachable assertion. The attack can be carried out remotely, and the exploit has been published.
- CVE-2026-78158Medium
A flaw has been found in Open5GS 2.8.0 in the unknown code of the AMF UEContextReleaseRequest Path Handler component. Executing a manipulation can lead to improper authorization. The attack can be launched remotely.
- CVE-2026-78157High
A vulnerability was detected in Open5GS 2.8.0 in the pcrf_rx_aar_cb function of src/pcrf/pcrf-rx-path.c in the Rx AA-Request Handler component. Manipulation leads to an out-of-bounds read. The attack can be initiated remotely.
- CVE-2026-71676High
Buffer overflow vulnerability in Open5GS v.2.7.0 allows a remote attacker to cause a denial of service via the NAS 5GS decoder chain, triggered when the message type byte of a NAS PDU is mutated.
- CVE-2026-71675High
An issue in Open5GS v.2.7.0 allows a remote attacker to cause a denial of service via the ngap_send_to_nas() function in src/amf/ngap-path.c.
- CVE-2025-15687Medium
A security flaw in Open5GS up to 2.7.6 affects the smf_gx_cca_cb function of the SMF Diameter Gx Credit-Control-Answer Handler, leading to denial of service. The attack can be launched remotely, and the exploit has been publicly released.
Original NVD description (English source)
A security vulnerability has been detected in Open5GS 2.8.0. Affected by this issue is the function hss_ogs_diam_s6a_air_cb of the file src/hss/hss-s6a-path.c of the component S6a Authentication-Information-Request Handler. Such manipulation of the argument Visited-PLMN-Id leads to heap-based buffer overflow. The attack may be performed from remote. The name of the patch is a9c82ee0b590d76a581b0580cb46b598984e2392. A patch should be applied to remediate this issue.