Description
A vulnerability was identified in Open5GS up to 2.7.1. This issue affects the function pcrf_rx_aar_cb of the file src/pcrf/pcrf-rx-path.c of the component Diameter Rx Handler. The manipulation of the argument num_of_media_component/num_of_sub leads to buffer overflow. The attack can be initiated remotely. The exploit is publicly available and might be used. Upgrading to version 2.7.2 is capable of addressing this issue. The identifier of the patch is 87b4e4535c77ded627cdb6f4e4e2e3ea761f40b7. It is recommended to upgrade the affected component.
Published: 2026-08-12
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A buffer overflow occurs in the Open5GS Diameter Rx Handler when the parameters num_of_media_component and num_of_sub are manipulated in the function pcrf_rx_aar_cb. This flaw can corrupt memory and potentially allow an attacker to execute arbitrary code, compromising the confidentiality, integrity, and availability of the affected system. The weakness corresponds to the classic buffer overflow class of vulnerabilities (CWE-119, CWE-120).

Affected Systems

The vulnerability affects Open5GS versions up to 2.7.1. All deployments running these or older releases of the Open5GS Diameter Rx component are potentially exposed. Version 2.7.2 includes the patch identified by commit 87b4e4535c77ded627cdb6f4e4e2e3ea761f40b7, which resolves the overflow.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1% reflects a very low estimated exploitation probability at this time. Based on the description, it is inferred that the flaw can be triggered remotely through a crafted Diameter AAR request, and the exploit code is publicly available, though the vulnerability is not listed in CISA’s KEV catalogue.

Generated by OpenCVE AI on August 12, 2026 at 15:04 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Open5GS patch in release v2.7.2 or later, using the commit 87b4e4535c77ded627cdb6f4e4e2e3ea761f40b7 as reference.
  • If an immediate upgrade is not possible, limit inbound Diameter Rx traffic to trusted peers by configuring firewall rules or access control lists to prevent unauthenticated remote access.
  • Enable detailed logging of AAR messages and monitor for abnormal request sizes or repeated failures, which may indicate exploitation attempts.

Generated by OpenCVE AI on August 12, 2026 at 15:04 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 12 Aug 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 12 Aug 2026 01:15:00 +0000

Type Values Removed Values Added
Description A vulnerability was identified in Open5GS up to 2.7.1. This issue affects the function pcrf_rx_aar_cb of the file src/pcrf/pcrf-rx-path.c of the component Diameter Rx Handler. The manipulation of the argument num_of_media_component/num_of_sub leads to buffer overflow. The attack can be initiated remotely. The exploit is publicly available and might be used. Upgrading to version 2.7.2 is capable of addressing this issue. The identifier of the patch is 87b4e4535c77ded627cdb6f4e4e2e3ea761f40b7. It is recommended to upgrade the affected component.
Title Open5GS Diameter Rx pcrf-rx-path.c pcrf_rx_aar_cb buffer overflow
First Time appeared Open5gs
Open5gs open5gs
Weaknesses CWE-119
CWE-120
CPEs cpe:2.3:a:open5gs:open5gs:*:*:*:*:*:*:*:*
Vendors & Products Open5gs
Open5gs open5gs
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Open5gs Open5gs
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-12T12:41:01.378Z

Reserved: 2026-08-09T17:50:35.171Z

Link: CVE-2024-14044

cve-icon Vulnrichment

Updated: 2026-08-12T12:40:53.286Z

cve-icon NVD

Status : Deferred

Published: 2026-08-12T01:17:06.207

Modified: 2026-08-12T20:59:21.023

Link: CVE-2024-14044

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-12T15:30:02Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-120

    Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')