Null Pointer Dereference in Open5GS Transfer Endpoint Affects Remote Operations
CVE-2026-82588

5.3MEDIUM

Key Information:

Vendor

Open5GS

Status
Open5gs
Vendor
CVE Published:
30 August 2026

What is CVE-2026-82588?

A vulnerability in Open5GS versions up to 2.7.7 allows for remote exploitation through the Transfer Endpoint component. By manipulating the processing of the file src/amf/namf-handler.c, an attacker can trigger a null pointer dereference, leading to potential denial of service. Users are strongly advised to upgrade to version 2.8.0 or later, which includes critical patches to address this issue.

Affected Version(s)

Open5GS 2.7.0

Open5GS 2.7.1

Open5GS 2.7.2

References

https://vuldb.com/vuln/397083
vdb-entry
https://vuldb.com/vuln/397083/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-82588
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

ZiyuLin (VulDB User)
.