CVE-2026-116543
HIGH
8,7
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A
HIGH
7,5
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: none
Integrity: none
Availability: high
Description
Open5GS 1.3.0 through 2.8.0 contains a heap out-of-bounds write vulnerability in parse_multipart() that allows unauthenticated attackers to corrupt memory by supplying an empty multipart boundary. Attackers can send a single crafted multipart/related request to the SBI interface of any network function, overflowing the lookbehind buffer and crashing it.
787
Out-of-bounds Write
DraftCommon Consequences
Security Scopes Affected:
Integrity
Availability
Other
Potential Impacts:
Modify Memory
Execute Unauthorized Code Or Commands
Dos: Crash, Exit, Or Restart
Unexpected State
Applicable Platforms
Languages:
Memory-Unsafe, C, C++, Assembly
Technologies:
ICS/OT
https://github.com/open5gs/open5gs
https://github.com/open5gs/open5gs/blob/v2.8.0/lib/sbi/contrib/multipart_parser…
https://github.com/open5gs/open5gs/blob/v2.8.0/lib/sbi/message.c#L3372
https://github.com/open5gs/open5gs/commit/6820c2743b5b5e126e3755d2f92dae2b23673…
https://github.com/open5gs/open5gs/security/advisories/GHSA-25v2-v588-jq8g
https://www.vulncheck.com/advisories/open5gs-1.3.0-through-2.8.0-heap-out-of-bo…