CVE-2026-116544GHSA-vp5f-rg8g-8p7j
Open5GS 2.6.1 through 2.8.0 Out-of-Bounds Read via parse_scheme_output
open5gs open5gs
CVSS
6.3MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
Open5GS 2.6.1 through 2.8.0 contains an out-of-bounds read vulnerability in parse_scheme_output() in lib/sbi/conv.c during SUCI de-concealment due to incomplete length validation. Remote unauthenticated UEs or SBI peers can submit a crafted SUCI with a 42-byte scheme output to a UDM, triggering a heap over-read past the buffer.
Text from CVE List
Affected versions 1
- open5gsaffected: 2.6.1 through 2.8.0CVE List
References 5
- github.com/open5gs/open5gs/commit/fdddcd5e3359703f0a945b308e64494a18a534f1Fixvia CVE List
- github.com/open5gs/open5gs/security/advisories/GHSA-vp5f-rg8g-8p7jAdvisoryvia CVE List
- vulncheck.com/advisories/open5gs-2.6.1-through-2.8.0-out-of-bounds-read-via-parse-scheme-outputAdvisoryvia CVE List
- github.com/open5gs/open5gs/blob/v2.8.0/lib/sbi/conv.c#L39Referencevia CVE List
- github.com/open5gs/open5gsReferencevia CVE List