Open5GS CVE-2026-108102

Requires the attacker to be able to send UDP packets to the SMF's PFCP interface on port 8805 - specifically a PFCP Session Report Request carrying a Volume Measurement IE whose flag bits are all set while the IE body is too short to contain the declared fields, causing the parser to read beyond the IE buffer. No authentication is required (PR:N) and default configurations of Open5GS through 2.8.0 are affected. The key LIMITING factor is network exposure of the PFCP N4 interface: in standard 5G core architecture this interface sits on an internal control-plane network between SMF and UPF and is not intended to be internet-reachable, so successful exploitation generally presupposes a foothold on, or a routing path into, the core network segment. Impact is limited to SMF crash/denial of service; the over-read data is not disclosed to the attacker.

This is a medium-severity (CVSS 4.0 base 6.9) heap out-of-bounds read with availability-only impact (VA:L; VC:N/VI:N). The CVSS vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates a network-reachable, low-complexity, unauthenticated trigger, which raises concern, but the real-world risk is materially tempered by two factors the raw score understates. First, the affected interface is the PFCP N4 interface on UDP 8805 between the SMF and UPF - in correct 5G core deployments this is an internal control-plane segment, not an internet-facing service, so 'network vector' here usually means 'reachable from within the core network' rather than 'reachable from the public internet'; defenders should treat AV:N with that caveat. Second, the impact is a crash/DoS of the SMF, not code execution or data theft - the vendor's VC:N correctly reflects that the up-to-48-byte over-read is not returned to the attacker, so despite the 'Information Disclosure' tag this is functionally a denial-of-service against the 5G control plane rather than a confidentiality breach. No EPSS score was supplied and the CVE is NOT in CISA KEV; no public exploit was provided in the intelligence. Net assessment: a legitimate patch-worthy control-plane DoS, but not an emergency mass-exploitation threat - prioritize for core-network operators but below internet-exposed RCE-class issues.

An attacker with access to the 5G core network segment (or any path to the SMF's PFCP N4 interface) sends a single crafted PFCP Session Report Request to UDP port 8805 containing a Volume Measurement IE that sets all length flags but is truncated. The SMF's ogs_pfcp_parse_volume_measurement() reads past the IE buffer by up to 48 bytes, which can crash the SMF and disrupt session management across the core. No public exploit code was identified in the provided intelligence, though the vendor advisory and precise code location make reproduction straightforward.