EUVD-2026-68289
GHSA-qm67-7h74-xjp2
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible SBI API requires low-privilege NF credentials (PR:L); impact limited to availability crash with no code execution or data exposure confirmed.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was determined in Open5GS up to 2.7.7. This vulnerability affects the function amf_namf_comm_decode_ue_mm_context_list of the file src/amf/namf-handler.c of the component AMF. This manipulation of the argument ueContext.mmContextList[*].allowedNssai causes memory corruption. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2.8.0 is able to resolve this issue. Patch name: abf8a836564b966b5141110fc25ed413c4f17522. It is recommended to upgrade the affected component.
AnalysisAI
Memory corruption in Open5GS versions up to 2.7.7 allows a low-privileged remote attacker to crash the Access and Mobility Management Function (AMF) by sending a crafted UE MM context transfer request with an oversized allowedNssai array. The vulnerable function amf_namf_comm_decode_ue_mm_context_list in src/amf/namf-handler.c lacked both null-pointer checks and array bounds enforcement on mmContextList[*].allowedNssai entries, relying instead on ogs_assert() which terminates the process rather than handling the error gracefully. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to send a crafted HTTP/2 SBI request to the AMF's Namf_Communication interface - specifically the UE context transfer endpoint. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world risk is constrained but operationally meaningful for telecom deployments. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Open5GS to version 2.8.0, which contains the complete fix via commit abf8a836564b966b5141110fc25ed413c4f17522. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-119 – Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today