EUVD-2026-68291
GHSA-wg2g-528h-36cm
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable SBI requires low privilege; crashing the central AMF denies 5G service to all managed UEs, warranting A:H over the input's lower assessment.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was identified in Open5GS up to 2.7.7. This issue affects some unknown processing of the file src/amf/namf-handler.c of the component Transfer Endpoint. Such manipulation leads to null pointer dereference. The attack can be launched remotely. Upgrading to version 2.8.0 is capable of addressing this issue. The name of the patch is abf8a836564b966b5141110fc25ed413c4f17522. Upgrading the affected component is advised.
AnalysisAI
Null pointer dereference in Open5GS versions up to 2.7.7 allows network-accessible low-privileged attackers to crash the AMF (Access and Mobility Management Function) by sending crafted SBI messages with missing required body fields to the N1/N2 Transfer Endpoint. The vulnerability exists across multiple code paths in src/amf/namf-handler.c, including UE context transfer, registration status update, and UE MM context list decoding, where pointers were dereferenced without null guards. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires low-privileged network access to the Open5GS AMF's Service-Based Interface (SBI) - specifically the namf-comm endpoints for N1/N2 message transfer (POST /ue-contexts/{ueContextId}/n1-n2-messages), UE context transfer, and registration status update. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms network accessibility with low complexity and low privileges required - no special attack prerequisites beyond access to the AMF SBI network segment. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Open5GS to version 2.8.0 or later, the vendor-released patch confirmed at https://github.com/open5gs/open5gs/releases/tag/v2.8.0 via commit abf8a836564b966b5141110fc25ed413c4f17522. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-404 – Improper Resource Shutdown or Release
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today