CVE-2026-116544

Open5GS 2.6.1 through 2.8.0 Out-of-Bounds Read via parse_scheme_output

Published Oct 26, 2026 CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Description

Open5GS 2.6.1 through 2.8.0 contains an out-of-bounds read vulnerability in parse_scheme_output() in lib/sbi/conv.c during SUCI de-concealment due to incomplete length validation. Remote unauthenticated UEs or SBI peers can submit a crafted SUCI with a 42-byte scheme output to a UDM, triggering a heap over-read past the buffer.

Analysis

Technical impact

Open5GS 2.6.1 through 2.8.0 contains an out‑of‑bounds read in the parse_scheme_output() function during SUCI de‑concealment. The flaw occurs because the length of the scheme output is not fully validated, allowing a heap over‑read when a 42‑byte SUCI is processed. An attacker could trigger memory exposure but the CVSS score indicates moderate impact. The weakness is CWE‑125.

Affected Systems

Affected systems are implementations of the Open5GS core network platform, specifically versions 2.6.1 through 2.8.0. These versions are used in 5G core deployments that expose the UDM service to untrusted users or peers.

Risk and Exploitability

The CVSS vector for this vulnerability is 6.3, categorizing it as moderate. EPSS is not available, so the current heuristic adoption probability is uncertain. The flaw is not listed in CISA KEV, implying no known widespread exploitation. Attackers can trigger the read remotely without authentication by sending a crafted SUCI to the UDM, making the vulnerability likely to be feasible in exposed service environments.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

open5gs

unaffected

Version	Status	Constraints
`2.6.1`	affected	≤ 2.8.0

No data.

Vendor Product Versions

Open5gs

Version	Status	Scheme	Platform
`[2.6.1,2.8.0]`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Open5GS to the latest available version (e.g., 2.8.1 or newer) where the parse_scheme_output() over‑read bug has been fixed.
If an upgrade is temporarily infeasible, isolate the UDM service from untrusted networks or apply network segmentation to restrict access to trusted peers only.
As a temporary workaround, patch the conv.c source by inserting a correct length validation check around the scheme output processing before rebuilding and redeploying the Open5GS binaries.

Generated by OpenCVE AI on October 26, 2026 at 16:21 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity High

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.354% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/open5gs/open5gs
https://github.com/open5gs/open5gs/blob/v2.8.0/lib/sbi/conv.c#L39
https://github.com/open5gs/open5gs/commit/fdddcd5e3359703f0a945b308e64494a18a534f1
https://github.com/open5gs/open5gs/security/advisories/GHSA-vp5f-rg8g-8p7j
https://www.vulncheck.com/advisories/open5gs-2.6.1-through-2.8.0-out-of-bounds-read-via-parse-scheme-output

History

Oct 26, 2026 5:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Oct 26, 2026 3:30 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Open5GS 2.6.1 through 2.8.0 contains an out-of-bounds read vulnerability in parse_scheme_output() in lib/sbi/conv.c during SUCI de-concealment due to incomplete length validation. Remote unauthenticated UEs or SBI peers can submit a crafted SUCI with a 42-byte scheme output to a UDM, triggering a heap over-read past the buffer.
Title		Open5GS 2.6.1 through 2.8.0 Out-of-Bounds Read via parse_scheme_output
First Time appeared		Open5gs Open5gs open5gs
Weaknesses		CWE-125
CPEs		cpe:2.3:a:open5gs:open5gs::::::::
Vendors & Products		Open5gs Open5gs open5gs
References		https://github.com/open5gs/open5gs https://github.com/open5gs/open5gs/blob/v2.8.0/lib/sbi/conv.c#L39 https://github.com/open5gs/open5gs/commit/fdddcd5e3359703f0a945b308e64494a18a534f1 https://github.com/open5gs/open5gs/security/advisories/GHSA-vp5f-rg8g-8p7j https://www.vulncheck.com/advisories/open5gs-2.6.1-through-2.8.0-out-of-bounds-read-via-parse-scheme-output
Metrics		cvssV3_1 `{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N'}` cvssV4_0 `{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}`