What is the CVSS score of CVE-2026-32320?

CVE-2026-32320 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of Suse are affected by CVE-2026-32320?

CVE-2026-32320 presents notable security risk, a out-of-bounds read vulnerability rated CVSS 6.5. Exploitation could cause memory corruption or application crashes.. A patch is available.

How to fix or mitigate CVE-2026-32320?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Suse CVE-2026-32320

MEDIUM

Out-of-bounds Read (CWE-125)

2026-03-12 https://github.com/ellanetworks/core

GHSA-j478-p7vq-3347

Denial Of Service Information Disclosure Buffer Overflow Suse

6.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

SUSE

MEDIUM

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 13, 2026 - 08:35 vuln.today

CVE Published

Mar 12, 2026 - 20:33 nvd

MEDIUM 6.5

DescriptionGitHub Advisory

Summary

Ella Core panics when processing a PathSwitchRequest containing UE Security Capabilities with zero-length NR encryption or integrity protection algorithm bitstrings, resulting in a denial of service.

Impact

An attacker able to send crafted NGAP messages to Ella Core can crash the process, causing service disruption for all connected subscribers. No authentication is required.

Fix

Added length validation on NR algorithm bitstrings before accessing them in the PathSwitchRequest handler.

AnalysisAI

Medium severity vulnerability in Ella Networks Core. Ella Core panics when processing a PathSwitchRequest containing UE Security Capabilities with zero-length NR encryption or integrity protection algorithm bitstrings, resulting in a denial of service.

Technical ContextAI

Vulnerability Type: Out-of-bounds Read (CWE-125) CVSS 3.1: 6.5/10.0 — Attack Vector: Network | Complexity: Low | Privileges Required: Low | User Interaction: None Attack Techniques: Information Disclosure, Denial Of Service, Buffer Overflow Source: https://github.com/ellanetworks/core