Open5GS EUVD-2026-64675

Exploitation requires network-level access to the PCRF's Diameter Rx interface, an internal 5G/4G core interface not exposed to the public internet in standard deployments. The attacker must be positioned as a recognized Diameter peer (PR:L) - either a legitimate or compromised Application Function, or a host that can impersonate one on the internal core network. The vulnerability is triggered specifically by sending a Diameter Rx AA-Request containing either: (a) a Framed-IP-Address AVP with a null avp_value or a data length other than OGS_IPV4_LEN (4 bytes), or (b) a Framed-IPv6-Prefix AVP with a null avp_value or a data length other than OGS_PAA_IPV6_LEN. Exploitation is constrained by the requirement for Diameter Rx peer access and internal network positioning; environments with strict network segmentation isolating the 5G core from untrusted hosts are significantly less exposed than the raw CVSS AV:N metric implies.

The CVSS 4.0 score of 5.3 with vector AV:N/AC:L/AT:N/PR:L/UI:N reflects network-reachable, low-complexity exploitation requiring low privilege. In practice, the Diameter Rx interface is an internal 5G/4G core interface not exposed to the public internet - an attacker must first obtain a position as a Diameter peer (e.g., by compromising an Application Function node or reaching the internal core network), making the effective attack surface much narrower than AV:N alone implies. The CVSS 4.0 E:P designation elevates concern above purely theoretical, but the absence of a CISA KEV entry and the restricted interface exposure suggest exploitation is unlikely to be opportunistic or at scale. The impact metrics VC:L/VI:L/VA:L and SC:L/SI:L/SA:L across both vulnerable and subsequent systems appear slightly overstated for a pure out-of-bounds read; confidentiality and availability impacts are plausible (memory disclosure and process crash), but integrity and subsequent-system impacts are inferred rather than directly demonstrated by the available patch data. Operators running the PCRF component in network-segmented deployments face materially lower real-world risk than the score suggests.

An attacker who has compromised an internal Application Function node - or who has otherwise gained Diameter peer access to the PCRF Rx interface - crafts an AA-Request with a Framed-IP-Address AVP whose avp_value is null or whose data length does not match the expected 4-byte IPv4 size. When the unpatched pcrf_rx_aar_cb() processes the message, it dereferences the null or undersized pointer, triggering an out-of-bounds read that may expose adjacent heap memory or crash the PCRF process; a proof-of-concept is indicated by the CVSS 4.0 E:P flag but no specific public PoC code has been confirmed in available sources.