CVE-2026-78157
Received Received - Intake

Out-of-Bounds Read in Open5GS Rx AA-Request Handler

Publication date: 2026-08-24

Last updated on: 2026-08-24

Assigner: VulDB

Description
A vulnerability was detected in Open5GS 2.8.0. This affects the function pcrf_rx_aar_cb of the file src/pcrf/pcrf-rx-path.c of the component Rx AA-Request Handler. Performing a manipulation results in out-of-bounds read. It is possible to initiate the attack remotely. The patch is named c18dc6938bf63cc7374315d3dca303d92066e746. To fix this issue, it is recommended to deploy a patch.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-24
Last Modified
2026-08-24
Generated
2026-08-24
AI Q&A
2026-08-24
EPSS Evaluated
N/A
NVD
CVE-2026-78157
EUVD
EUVD-2026-64675

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
open5gs open5gs 2.8.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.
CWE-119 The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-78157 is an out-of-bounds read vulnerability in Open5GS 2.8.0 affecting the PCRF component. It occurs when processing Rx AAR messages with a Framed-IP-Address AVP shorter than 4 bytes. The PCRF fails to validate the AVP length before using it as a 4-byte hash key, causing a buffer overflow in the pcrf_rx_aar_cb function.

Detection Guidance

Monitor Open5GS logs for crashes or errors related to Rx AAR message processing, particularly when Framed-IP-Address AVP is shorter than 4 bytes. Check for segmentation faults in the pcrf_rx_aar_cb function. Use network traffic analysis tools like Wireshark to inspect Diameter Rx protocol messages for malformed Framed-IP-Address AVPs.

Impact Analysis

This vulnerability can be exploited remotely by sending a malformed Rx AAR message to the PCRF. It may cause memory corruption, crashes, or denial of service. Attackers could potentially gain unauthorized access or disrupt network services.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by potentially exposing sensitive subscriber data due to memory corruption or crashes in the PCRF module. Out-of-bounds reads may lead to unauthorized access or data leaks, violating confidentiality requirements under these regulations.

Mitigation Strategies

Apply the patch c18dc6938bf63cc7374315d3dca303d92066e746 immediately. Ensure Framed-IP-Address AVP length validation is enforced in Rx AAR handling. Update Open5GS to a patched version if available. Monitor for malformed Diameter messages and block suspicious traffic at the network perimeter.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-78157. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart