CVE-2026-116544
Deferred Deferred - Pending Action

Out-of-Bounds Read in Open5GS SUCI De-concealment

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: VulnCheck

Description
Open5GS 2.6.1 through 2.8.0 contains an out-of-bounds read vulnerability in parse_scheme_output() in lib/sbi/conv.c during SUCI de-concealment due to incomplete length validation. Remote unauthenticated UEs or SBI peers can submit a crafted SUCI with a 42-byte scheme output to a UDM, triggering a heap over-read past the buffer.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-116544
EUVD
EUVD-2026-109914

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
open5gs open5gs 2.6.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Open5GS versions 2.6.1 to 2.8.0 have an out-of-bounds read flaw in the parse_scheme_output() function within lib/sbi/conv.c. This occurs during SUCI de-concealment due to insufficient length validation. Attackers can exploit this by sending a maliciously crafted SUCI containing a 42-byte scheme output to a UDM, causing the system to read beyond the allocated buffer in memory.

Impact Analysis

Remote unauthenticated users or SBI peers could exploit this to cause a denial of service or potentially access sensitive memory data. The impact includes service disruption for the network and possible exposure of confidential information stored in memory.

Mitigation Strategies

Upgrade Open5GS to a version later than 2.8.0 to address the out-of-bounds read vulnerability in SUCI de-concealment.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116544. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart