Open5GS EUVD-2026-95794

The target must be an Open5GS UPF (version 2.8.0 or earlier) reachable on UDP port 8805, and the attacker must be able to send PFCP Session Establishment or Modification Requests to it. The malicious packet must carry a Dropped DL Traffic Threshold IE with the DLPA and DLBY flags set but an IE length shorter than the flagged fields require, so the parser reads past the buffer. No authentication is required (PR:N) and no user interaction (UI:N). The key limiting factor is network position: the PFCP N4 interface is an internal core-network link between SMF and UPF and is not typically exposed to the internet, so exploitation realistically requires access to the operator's core signaling segment.

This is a medium-severity denial-of-service issue rather than a top-tier priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes remote, unauthenticated, low-complexity reachability, but the only impact metric set is VA:L - no confidentiality (VC:N) or integrity (VI:N) impact - so despite being classified as an out-of-bounds read (CWE-125), the realistic outcome is a UPF crash, not data theft, consistent with the description's 'potentially crashing the UPF.' No EPSS score, KEV listing, or public exploit code is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The strongest mitigating real-world factor is deployment context: PFCP (the N4 interface, UDP 8805) runs between the SMF and UPF inside the mobile core and is not normally internet-exposed, so the nominal AV:N network vector is in practice reachable only by an attacker already positioned on the core signaling network. Net: a genuine but bounded availability risk - patch on a normal cycle and verify N4 segmentation; it is not a drop-everything emergency.

An attacker with access to the mobile core's N4 signaling segment sends a crafted PFCP Session Establishment or Modification Request to the UPF on UDP port 8805 with the DLPA and DLBY flags set but a truncated Dropped DL Traffic Threshold IE. The parser ogs_pfcp_parse_dropped_dl_traffic_threshold() reads past the short IE buffer (heap out-of-bounds read), crashing the UPF and interrupting user-plane traffic. No public exploit code was identified in the provided data, though the VulnCheck advisory and the fix commit document the exact flaw.