Is there a public PoC exploit available for CVE-2026-10114?

Yes, a public proof-of-concept exploit is available for CVE-2026-10114. Prioritise patching immediately. EPSS: 0.0%.

Open5GS CVE-2026-10114

Q: What is the CVSS score of CVE-2026-10114?

CVE-2026-10114 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33456 LOW

Out-of-bounds Write (CWE-787)

2026-05-30 VulDB

GHSA-2vp2-c9x2-m79c

Memory Corruption Buffer Overflow Open5gs

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

May 30, 2026 - 11:22 NVD

MEDIUM LOW

CVSS changed

May 30, 2026 - 11:22 NVD

4.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

May 30, 2026 - 10:42 vuln.today

DescriptionCVE.org

A vulnerability was determined in Open5GS up to 2.7.7. Affected by this issue is the function handle_scp_info in the library lib/sbi/nnrf-handler.c of the component Shared NF-profile Parser. This manipulation causes out-of-bounds write. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. To fix this issue, it is recommended to deploy a patch.

AnalysisAI

Out-of-bounds write in Open5GS versions up to 2.7.7 allows a remote, low-privileged attacker to crash the NRF (Network Repository Function) component by sending a malformed SCP info payload, resulting in a denial-of-service condition. The vulnerability resides in the handle_scp_info function within the Shared NF-profile Parser (lib/sbi/nnrf-handler.c), a critical parsing path for 5G service-based interface communication. A public proof-of-concept exploit has been disclosed via the project's GitHub issue tracker, materially lowering the bar for exploitation against unpatched deployments.

Technical ContextAI

Open5GS is an open-source implementation of a 5G SA (Standalone) core network and 4G EPC, widely used in research, lab, and some production 5G environments. The affected component is the NRF (Network Repository Function) handler responsible for parsing Shared NF-profile data exchanged over the 5G Service-Based Interface (SBI), specifically messages carrying SCP (Service Communication Proxy) metadata. The root cause is CWE-787 (Out-of-bounds Write): the handle_scp_info function in lib/sbi/nnrf-handler.c fails to adequately validate or bound-check input data during NF-profile parsing, allowing a write operation to corrupt memory beyond the allocated buffer. CPE data (cpe:2.3:a:n/a:open5gs:*:*:*:*:*:*:*:*) covers all Open5GS builds up to 2.7.7. In 5G core architectures, NRF is a central discovery and registration service contacted by all other network functions, meaning a DoS against it can cascade to impair NF registration and service discovery across the entire core.

RemediationAI

The primary remediation is to apply the vendor-released patch addressing the out-of-bounds write in handle_scp_info. Per the CVSS temporal vector (RL:O), an official fix has been issued, though the specific patched release version is not explicitly confirmed in the available reference data - operators should check the Open5GS GitHub releases page (https://github.com/open5gs/open5gs/) for versions released after 2.7.7 and apply the latest available build. The GitHub issue at https://github.com/open5gs/open5gs/issues/4468 should be monitored for patch confirmation and commit references. As a compensating control pending patching, restrict SBI interface access to only trusted, authenticated internal network function clients via network segmentation or firewall rules targeting the NRF's HTTP/2 SBI port; note this trade-off is that overly restrictive rules may interfere with legitimate NF registration. If the NRF can be isolated from external or untrusted 5G SBI endpoints without impacting core operations, that boundary enforcement reduces exploitable surface while the patch is staged.