EUVD-2026-61282
GHSA-g8r5-63w3-725c
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NAS decoder is reachable pre-authentication over the network with no complexity; impact is strictly availability as the overflow causes a process crash with no data exposure.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
4DescriptionCVE.org
Buffer Overflow vulnerability in Open5GS v.2.7.0 allows a remote attacker to cause a denial of service via the NAS 5GS decoder chain, triggered when the message type byte of a NAS PDU is mutated
AnalysisAI
Heap-based buffer overflow in Open5GS v.2.7.0 allows remote unauthenticated attackers to crash the NAS 5GS decoder chain by sending a NAS PDU with a mutated message type byte, resulting in denial of service to the AMF component and all connected UEs. The vulnerability is network-accessible with no authentication or user interaction required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N), making it trivially reachable from any host with access to the AMF N1 interface. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The NAS 5GS decoder is invoked prior to UE authentication, so no credentials or session state are required - a single malformed NAS PDU from any network-accessible host is sufficient to trigger the overflow. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.5 High score accurately reflects the network-accessible, unauthenticated, zero-complexity attack surface - AV:N/AC:L/PR:N/UI:N is consistent with the NAS interface being exposed to any UE or gNB that can route to the AMF. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch has been identified at time of analysis - no specific fix version appears in the provided intelligence data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all production Open5GS v2.7.0 deployments and immediately restrict network access to the AMF N1 interface to only trusted RAN equipment and signaling gateways. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today