Out-of-Bounds Read Vulnerability in Open5GS by Open5GS

CVE-2026-116544

What is CVE-2026-116544?

Open5GS versions 2.6.1 through 2.8.0 are affected by an out-of-bounds read vulnerability located in the parse_scheme_output() function within lib/sbi/conv.c. This security flaw arises due to inadequate length validation during the de-concealment of SUCI (Subscription Concealed Identifier). An attacker can exploit this vulnerability by sending a crafted SUCI with a specially formatted 42-byte scheme output to a UDM (User Data Management), which may cause a heap over-read that exceeds the defined buffer limits. Remote unauthenticated user equipment (UE) or SBI peers can trigger this vulnerability, potentially leading to unintended information disclosure or system instability.

References