Live › vulnerability › CVE-2026-116544
Go to dashboardOpen5GS 2.6.1 through 2.8.0 has an out-of-bounds read in parse_scheme_output() during SUCI de-concealment, where length checks are incomplete. A remote unauthenticated UE or SBI peer can send a crafted 42-byte scheme output to a UDM and read past a heap buffer.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 16:31 UTC. All times on this page are UTC.
Operators running Open5GS 2.6.1 through 2.8.0 as a 5G core whose UDM is reachable from UEs or SBI peers, since the crafted SUCI arrives over the network path. Lab or private deployments with no untrusted access to the UDM face less exposure. The sources do not describe a non-default configuration requirement.
No product ranges from the sources yet.
open5gs-udmd --version or the package manager, and see whether it falls in 2.6.1 through 2.8.02.8.0Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Open5GS 2.6.1 through 2.8.0 contains an out-of-bounds read vulnerability in parse_scheme_output() in lib/sbi/conv.c during SUCI de-concealment due to incomplete length validation. Remote unauthenticated UEs or SBI peers can submit a crafted SUCI with a 42-byte scheme output to a UDM, triggering a heap over-read past the buffer.
This page as .md · .json · in your agent: get_signal("CVE-2026-116544")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.