Open5GS CVE-2026-78156

Exploitation requires the attacker to establish a Diameter S6a connection to the HSS with low-privilege Diameter peer credentials (PR:L per the supplied CVSS 4.0 vector), which in practice means having network access to the EPC's internal signaling plane - typically not reachable from the public internet. The triggering condition is sending an AIR message with a Visited-PLMN-Id AVP where os.len is not exactly 3 bytes (not equal to OGS_PLMN_ID_LEN); no special non-default configuration is required beyond a standard Open5GS HSS deployment with the S6a interface running. Exploitation is constrained by the Diameter peer authentication step (low privilege, but not zero) and by the non-public-internet exposure of the S6a interface. What limits exploitation in practice: the attacker must be inside the operator's core network segment or able to spoof/compromise a legitimate Diameter peer (MME, STP); unauthenticated internet attackers cannot reach this interface in conformant deployments.

The supplied CVSS 4.0 score of 2.1 with uniformly low impact metrics (VC:L/VI:L/VA:L/SC:L/SI:L/SA:L) appears understated relative to a heap overflow in a core authentication component; the low score reflects the constrained deployment context rather than inherent exploitability - PR:L requires Diameter peer credentials, which are not publicly obtainable. No EPSS value was included in the intelligence package, so exploitation probability cannot be numerically quantified. The E:P threat modifier in the provided CVSS 4.0 vector confirms proof-of-concept material exists, distinguishing this from a purely theoretical flaw; however, no CISA KEV listing was referenced, so confirmed active exploitation remains unsubstantiated. The subsequent-system impact indicators (SC:L/SI:L/SA:L) are plausible given the HSS's role as the authentication oracle - a crash or compromise propagates authentication failures to all connected MMEs. Practically, even a mid-sized municipal IT team in boleslawiec running a private LTE network on Open5GS should treat this as a medium-priority patch given the available PoC, despite the low CVSS score, because the HSS is a single point of failure for subscriber authentication. The primary limiting factor is the requirement for Diameter S6a network access, which is an internal, non-internet-exposed interface in any standards-compliant deployment.

An attacker with access to the core network Diameter segment - such as a compromised MME, a rogue signaling node inserted via SS7/Diameter interconnect, or a malicious insider - establishes a Diameter S6a connection to the Open5GS HSS and sends a crafted Authentication-Information-Request containing a Visited-PLMN-Id AVP whose octet-string length exceeds the expected 3-byte OGS_PLMN_ID_LEN. The HSS processes the request without validating the AVP length, triggering a heap buffer overflow in hss_ogs_diam_s6a_air_cb when the oversized data propagates into ogs_auc_kasme(). Depending on heap layout at runtime, the outcome ranges from an HSS process crash - denying authentication to all network subscribers - to potential arbitrary code execution within the HSS process; a proof-of-concept exists per the E:P signal in the CVSS 4.0 vector.