EUVD-2026-42632
GHSA-7vwm-q9fw-cfjw
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local-only UAF requiring low-privilege credentials; A:L added independently because use-after-free in context cleanup commonly causes process crashes, consistent with the DoS tag despite VA:N in the provided vector.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
1DescriptionCVE.org
A security flaw has been discovered in Open5GS 2.7.7. This affects the function amf_context_final of the file src/amf/context.c of the component AMF. Performing a manipulation results in use after free. The attack is only possible with local access. The exploit has been released to the public and may be used for attacks.
AnalysisAI
Use-after-free in Open5GS 2.7.7's AMF component allows a local low-privileged user to access freed memory within the amf_context_final function in src/amf/context.c, producing a low-severity confidentiality exposure. Exploitation is strictly local - no network vector exists - and a public proof-of-concept is confirmed by the CVSS 4.0 E:P supplemental modifier. This vulnerability is not listed in the CISA KEV catalog and carries a CVSS 4.0 base score of 1.9, reflecting its constrained real-world impact on what is a niche, telecom-research-oriented software stack.
Technical ContextAI
Open5GS is an open-source implementation of both the 5G Core (5GC) and EPC (4G/LTE) network stacks, commonly used in private 5G testbeds, academic research, and some operator lab environments. The affected component is the AMF (Access and Mobility Management Function), which handles UE registration, authentication coordination, and mobility management in 5G Standalone deployments. The vulnerable function amf_context_final in src/amf/context.c is responsible for tearing down and releasing AMF context structures during process cleanup or session termination. The root cause is classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), though the CVE description more precisely characterizes the flaw as a use-after-free - a memory safety subtype (typically CWE-416) where a pointer to freed heap memory is dereferenced again, potentially exposing residual data from the deallocated region. This CWE-119 versus use-after-free discrepancy should be verified against the upstream advisory. The CVSS 4.0 vector AV:L/AC:L/AT:N/PR:L/UI:N confirms fully local, low-complexity exploitation requiring no special attack prerequisites beyond a local shell session.
RemediationAI
Consult the vendor security advisory at https://github.com/open5gs/open5gs/security/advisories/GHSA-88pq-hpwv-2vjw to identify the specific patched release version - no exact fix version was confirmed in the available intelligence data, so the upgrade target must be validated there before deployment. Patch available per vendor advisory. As an interim compensating control, restrict local OS access to hosts running Open5GS AMF strictly to authorized operators, reducing the set of principals who could invoke the vulnerable context finalization path. In 5G core deployments, enforce least-privilege OS account policies and consider running AMF in an isolated container or virtual machine to limit the blast radius if local exploitation occurs - note that containerization adds operational complexity and does not patch the underlying memory management flaw. Monitoring for unexpected AMF process crashes may help detect exploitation attempts if the DoS behavior implied by the tags is real. Patching remains the only definitive resolution.
Same weakness CWE-119 – Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today