Buffer Overflow in Open5GS NAS 5GS Decoder

Executive Summary

CVE-2026-71676 is a heap-based buffer overflow in Open5GS affecting the AMF component. It occurs when a NAS 5GS message type is mutated from 0x57 (Authentication Response) to 0x4e (Service Accept), causing the decoder to misinterpret the payload. This leads to an out-of-bounds read in the `ogs_nas_5gs_decode_gprs_timer_2()` function, as the payload is processed incorrectly.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for crashes or memory corruption errors in Open5GS AMF logs, particularly around NAS 5GS message processing. Use AddressSanitizer (ASAN) during compilation to detect heap buffer overflows. Check for unusual SCTP traffic patterns on the N2 interface, especially malformed NAS PDUs with mutated message types.

Useful 0 Not Useful 0

Impact Analysis

An attacker with access to the AMF's N2 interface can exploit this by sending a malformed NAS PDU. This could cause a denial of service or potentially allow arbitrary code execution on the affected system, disrupting 5G network operations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Open5GS to a patched version beyond v2.7.2. If upgrading is not possible, restrict access to the AMF's N2 interface by firewall rules to prevent unauthorized SCTP connections. Monitor AMF logs for crashes or memory errors and apply input validation for NAS PDUs to reject malformed messages.

Useful 0 Not Useful 0