Skip to main content

Open5GS CVE-2026-78157

| EUVDEUVD-2026-64675 LOW
Out-of-bounds Read (CWE-125)
2026-08-24 VulDB GHSA-65jg-mq47-hgxf
Information Disclosure Buffer Overflow Open5gs
2.1
CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY
2.1 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
5.4 MEDIUM

Network-reachable Diameter interface requires low-privilege peer access (PR:L); out-of-bounds read yields confidentiality and availability impacts but no integrity impact (I:N); scope unchanged (S:U) as impact is confined to the PCRF process.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

4
Severity Changed
Aug 24, 2026 - 01:22 NVD
MEDIUM LOW
CVSS changed
Aug 24, 2026 - 01:22 NVD
5.3 (MEDIUM) 2.1 (LOW)
Source Code Evidence Fetched
Aug 24, 2026 - 00:43 vuln.today
Analysis Generated
Aug 24, 2026 - 00:43 vuln.today

DescriptionCVE.org

A vulnerability was detected in Open5GS 2.8.0. This affects the function pcrf_rx_aar_cb of the file src/pcrf/pcrf-rx-path.c of the component Rx AA-Request Handler. Performing a manipulation results in out-of-bounds read. It is possible to initiate the attack remotely. The patch is named c18dc6938bf63cc7374315d3dca303d92066e746. To fix this issue, it is recommended to deploy a patch.

AnalysisAI

Out-of-bounds read in Open5GS 2.8.0 PCRF Rx AA-Request handler allows remote low-privileged attackers with Diameter Rx interface access to send crafted AA-Request messages containing null or incorrectly-sized Framed-IP-Address or Framed-IPv6-Prefix AVPs, triggering memory reads beyond allocated boundaries. The patch commit c18dc6938bf63cc7374315d3dca303d92066e746 adds missing null and length validation for both AVP types; a tagged release incorporating it has not been independently confirmed. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Obtain internal Diameter Rx peer access
Delivery
Craft AA-Request with null or wrong-length Framed-IP-Address or Framed-IPv6-Prefix AVP
Exploit
Submit crafted message to PCRF Rx interface
Execution
Trigger null-pointer dereference and out-of-bounds read in pcrf_rx_aar_cb()
Impact
Leak adjacent heap memory or crash PCRF process
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires network-level access to the PCRF's Diameter Rx interface, an internal 5G/4G core interface not exposed to the public internet in standard deployments. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 5.3 with vector AV:N/AC:L/AT:N/PR:L/UI:N reflects network-reachable, low-complexity exploitation requiring low privilege. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker who has compromised an internal Application Function node - or who has otherwise gained Diameter peer access to the PCRF Rx interface - crafts an AA-Request with a Framed-IP-Address AVP whose avp_value is null or whose data length does not match the expected 4-byte IPv4 size. When the unpatched pcrf_rx_aar_cb() processes the message, it dereferences the null or undersized pointer, triggering an out-of-bounds read that may expose adjacent heap memory or crash the PCRF process; a proof-of-concept is indicated by the CVSS 4.0 E:P flag but no specific public PoC code has been confirmed in available sources.
Remediation Apply upstream patch commit c18dc6938bf63cc7374315d3dca303d92066e746 directly from the Open5GS repository (https://github.com/open5gs/open5gs/commit/c18dc6938bf63cc7374315d3dca303d92066e746). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Open5gs

View all
CVE-2025-15684 MEDIUM POC
5.5 Aug 12

Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
CVE-2025-15687 LOW POC
2.1 Aug 12

Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
CVE-2025-15686 LOW POC
2.1 Aug 12

Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
CVE-2024-40130 CRITICAL POC
9.8 Jul 16

open5gs v2.6.4 is vulnerable to Buffer Overflow. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
CVE-2024-40129 CRITICAL POC
9.8 Jul 16

Open5GS v2.6.4 is vulnerable to Buffer Overflow. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
CVE-2021-28122 CRITICAL POC
9.8 Mar 10

A request-validation issue was discovered in Open5GS 2.1.3 through 2.2.x before 2.2.1. Rated critical severity (CVSS 9.8
CVE-2025-15685 MEDIUM
5.3 Aug 12

Memory corruption in Open5GS versions through 2.7.1 is remotely exploitable via the freeDiameter protocol component, all
CVE-2021-25863 HIGH POC
8.8 Jan 26

Open5GS 2.1.3 listens on 0.0.0.0:3000 and has a default password of 1423 for the admin account. Rated high severity (CVS
CVE-2023-37023 HIGH POC
8.6 Jan 22

Open5GS MME versions <= 2.6.4 contain a reachable assertion in the `Uplink NAS Transport` packet handler. Rated high sev
CVE-2023-37021 HIGH POC
8.6 Jan 22

Open5GS MME version <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the

CVE-2023-37020 HIGH POC
8.6 Jan 22

Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the

CVE-2023-37019 HIGH POC
8.6 Jan 22

Open5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

CVE-2026-78157 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy