Is there a public PoC exploit available for CVE-2026-8252?

Yes, a public proof-of-concept exploit is available for CVE-2026-8252. Prioritise patching immediately. EPSS: 0.0%.

Open5GS CVE-2026-8252

Q: What is the CVSS score of CVE-2026-8252?

CVE-2026-8252 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-29006 LOW

NULL Pointer Dereference (CWE-476)

2026-05-10 VulDB

GHSA-6hj2-qqxq-44pp

Denial Of Service Null Pointer Dereference Open5gs

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

May 11, 2026 - 00:22 NVD

MEDIUM LOW

CVSS changed

May 11, 2026 - 00:22 NVD

4.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

May 11, 2026 - 00:00 vuln.today

CVE Published

May 10, 2026 - 23:15 nvd

MEDIUM 4.3

DescriptionCVE.org

A vulnerability was determined in Open5GS up to 2.7.7. Affected is the function smf_nsmf_handle_create_data_in_hsmf of the component SMF. Executing a manipulation can lead to null pointer dereference. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Null pointer dereference in Open5GS Session Management Function (SMF) up to version 2.7.7 allows authenticated remote attackers to cause denial of service by manipulating the smf_nsmf_handle_create_data_in_hsmf function. Publicly available exploit code exists, and the project has been notified but has not yet released a patch.

Technical ContextAI

Open5GS is a 5G core network implementation. The vulnerability resides in the SMF (Session Management Function) component, specifically in the smf_nsmf_handle_create_data_in_hsmf function which processes NSMF (Network Slice Management Function) requests for data session creation. The CWE-476 null pointer dereference indicates the function fails to validate or check for null pointers before dereferencing them, likely when processing crafted NSMF protocol messages. This is a common memory safety issue in C-based network applications handling complex protocol state.

RemediationAI

Upgrade Open5GS to a patched version once released by the project. As of the current analysis, no vendor-released patch version has been confirmed - the project has been notified but has not yet responded with a fix. Recommended interim mitigation: restrict network access to the SMF component to authenticated, trusted network elements only; implement network segmentation to isolate the SMF from untrusted 5G network participants; monitor SMF logs for abnormal NSMF requests or crashes indicative of exploitation attempts. Disable or restrict access to the smf_nsmf_handle_create_data_in_hsmf endpoint if operationally feasible. Monitor the official Open5GS GitHub repository (https://github.com/open5gs/open5gs/) and issue tracker (https://github.com/open5gs/open5gs/issues/4446) for patch announcements.