{"id":"CVE-2026-116544","kind":"vulnerability","aliases":["CVE-2026-116544"],"related":[],"title":"Open5GS: crafted SUCI triggers heap over-read in 5G core","description":"Open5GS 2.6.1 through 2.8.0 contains an out-of-bounds read vulnerability in parse_scheme_output() in lib/sbi/conv.c during SUCI de-concealment due to incomplete length validation. Remote unauthenticated UEs or SBI peers can submit a crafted SUCI with a 42-byte scheme output to a UDM, triggering a heap over-read past the buffer.","summary":"Open5GS 2.6.1 through 2.8.0 has an out-of-bounds read in parse_scheme_output() during SUCI de-concealment, where length checks are incomplete. A remote unauthenticated UE or SBI peer can send a crafted 42-byte scheme output to a UDM and read past a heap buffer.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["5g-core","infrastructure","open5gs","self-hosted","telecom"],"not_affected_if":["versions-outside-2.6.1-2.8.0"],"how_to_check":"- Check the installed Open5GS version with `open5gs-udmd --version` or the package manager, and see whether it falls in `2.6.1` through `2.8.0`\n- unknown whether the sources list a config setting that enables the vulnerable path","fix":"- Upgrade Open5GS to a release later than `2.8.0`\n- unknown: the sources do not name the fixed version","status":"open","published_at":"2026-10-26T16:17:20+00:00","first_seen_at":"2026-10-26T16:31:01+00:00","triaged_at":"2026-10-26T16:33:00+00:00","updated_at":"2026-10-26T16:33:00+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-26T16:33:00Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Open5GS to a release later than `2.8.0`\n- unknown: the sources do not name the fixed version","reach":"network","title":"Open5GS: crafted SUCI triggers heap over-read in 5G core","impact":"low","summary":"Open5GS 2.6.1 through 2.8.0 has an out-of-bounds read in parse_scheme_output() during SUCI de-concealment, where length checks are incomplete. A remote unauthenticated UE or SBI peer can send a crafted 42-byte scheme output to a UDM and read past a heap buffer.","category":"infrastructure","nicknames":[],"who_cares":["open5gs","5g-core","telecom","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Remote attacker reads heap memory past the buffer, possibly leaking data","analyst_note":"Find the upstream Open5GS advisory or fixed release version and confirm whether the SUCI path needs a non-default setting (check NVD link https://nvd.nist.gov/vuln/detail/CVE-2026-116544).","how_to_check":"- Check the installed Open5GS version with `open5gs-udmd --version` or the package manager, and see whether it falls in `2.6.1` through `2.8.0`\n- unknown whether the sources list a config setting that enables the vulnerable path","needs_analyst":true,"not_affected_if":["versions-outside-2.6.1-2.8.0"],"who_is_affected":"Operators running Open5GS 2.6.1 through 2.8.0 as a 5G core whose UDM is reachable from UEs or SBI peers, since the crafted SUCI arrives over the network path. Lab or private deployments with no untrusted access to the UDM face less exposure. The sources do not describe a non-default configuration requirement.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00067,"input_tokens":3378,"output_tokens":665,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116544':14A,17A '-2026':13A,16A '2.6.1':28B,77C '2.8.0':30B,79C '42':63B,117C '5g':10A,19B '5g-core':18B 'bound':36B,85C 'buffer':75B,132C 'byte':64B,118C 'check':49B 'conceal':46B,98C 'contain':80C 'core':11A,20B 'craft':2A,62B,113C 'cve':12A,15A 'de':45B,97C 'de-conceal':44B,96C 'due':99C 'heap':5A,74B,126C 'host':25B 'incomplet':51B,101C 'infrastructur':21B 'length':48B,102C 'lib/sbi/conv.c':93C 'open5gs':1A,22B,27B,76C 'out-of-bound':33B,82C 'output':41B,66B,91C,120C 'over-read':6A,127C 'pars':39B,89C 'past':72B,130C 'peer':58B,109C 'read':8A,37B,71B,86C,129C 'remot':53B,104C 'sbi':57B,108C 'scheme':40B,65B,90C,119C 'self':24B 'self-host':23B 'send':60B 'submit':111C 'suci':3A,43B,95C,114C 'telecom':26B 'trigger':4A,124C 'udm':69B,123C 'ue':55B,106C 'unauthent':54B,105C 'valid':103C 'vulner':87C","nicknames":[],"mitigations":[],"who_affected":"Operators running Open5GS 2.6.1 through 2.8.0 as a 5G core whose UDM is reachable from UEs or SBI peers, since the crafted SUCI arrives over the network path. Lab or private deployments with no untrusted access to the UDM face less exposure. The sources do not describe a non-default configuration requirement.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T16:17:20+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116544","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116544","severity":null,"published_at":"2026-10-26T16:17:20+00:00","modified_at":"2026-10-26T16:17:20+00:00","first_seen_at":"2026-10-26T16:31:01+00:00","fetched_at":"2026-10-26T16:31:01+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}