Description
Open5GS 2.6.1 through 2.8.0 contains an out-of-bounds read vulnerability in parse_scheme_output() in lib/sbi/conv.c during SUCI de-concealment due to incomplete length validation. Remote unauthenticated UEs or SBI peers can submit a crafted SUCI with a 42-byte scheme output to a UDM, triggering a heap over-read past the buffer.
Published: 2026-10-26
Score: 6.3 Medium
EPSS: n/a
KEV: No
Impact: Out-of-Bounds Read
Action: Apply Patch
AI Analysis

Impact

Open5GS 2.6.1 through 2.8.0 contains an out‑of‑bounds read in the parse_scheme_output() function during SUCI de‑concealment. The flaw occurs because the length of the scheme output is not fully validated, allowing a heap over‑read when a 42‑byte SUCI is processed. An attacker could trigger memory exposure but the CVSS score indicates moderate impact. The weakness is CWE‑125.

Affected Systems

Affected systems are implementations of the Open5GS core network platform, specifically versions 2.6.1 through 2.8.0. These versions are used in 5G core deployments that expose the UDM service to untrusted users or peers.

Risk and Exploitability

The CVSS vector for this vulnerability is 6.3, categorizing it as moderate. EPSS is not available, so the current heuristic adoption probability is uncertain. The flaw is not listed in CISA KEV, implying no known widespread exploitation. Attackers can trigger the read remotely without authentication by sending a crafted SUCI to the UDM, making the vulnerability likely to be feasible in exposed service environments.

Generated by OpenCVE AI on October 26, 2026 at 16:21 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Open5GS to the latest available version (e.g., 2.8.1 or newer) where the parse_scheme_output() over‑read bug has been fixed.
  • If an upgrade is temporarily infeasible, isolate the UDM service from untrusted networks or apply network segmentation to restrict access to trusted peers only.
  • As a temporary workaround, patch the conv.c source by inserting a correct length validation check around the scheme output processing before rebuilding and redeploying the Open5GS binaries.

Generated by OpenCVE AI on October 26, 2026 at 16:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 26 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 26 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Description Open5GS 2.6.1 through 2.8.0 contains an out-of-bounds read vulnerability in parse_scheme_output() in lib/sbi/conv.c during SUCI de-concealment due to incomplete length validation. Remote unauthenticated UEs or SBI peers can submit a crafted SUCI with a 42-byte scheme output to a UDM, triggering a heap over-read past the buffer.
Title Open5GS 2.6.1 through 2.8.0 Out-of-Bounds Read via parse_scheme_output
First Time appeared Open5gs
Open5gs open5gs
Weaknesses CWE-125
CPEs cpe:2.3:a:open5gs:open5gs:*:*:*:*:*:*:*:*
Vendors & Products Open5gs
Open5gs open5gs
References
Metrics cvssV3_1

{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N'}

cvssV4_0

{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Open5gs Open5gs
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-26T16:15:00.617Z

Reserved: 2026-10-26T14:30:59.265Z

Link: CVE-2026-116544

cve-icon Vulnrichment

Updated: 2026-10-26T15:38:06.567Z

cve-icon NVD

Status : Deferred

Published: 2026-10-26T16:17:20.007

Modified: 2026-10-26T17:17:27.303

Link: CVE-2026-116544

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-26T17:15:06Z

Weaknesses