CVE-2024-14044 in Open5GS
Summary
by MITRE • 08/12/2026
A vulnerability was identified in Open5GS up to 2.7.1. This issue affects the function pcrf_rx_aar_cb of the file src/pcrf/pcrf-rx-path.c of the component Diameter Rx Handler. The manipulation of the argument num_of_media_component/num_of_sub leads to buffer overflow. The attack can be initiated remotely. The exploit is publicly available and might be used. Upgrading to version 2.7.2 is capable of addressing this issue. The identifier of the patch is 87b4e4535c77ded627cdb6f4e4e2e3ea761f40b7. It is recommended to upgrade the affected component.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/13/2026
The vulnerability in Open5GS up to version 2.7.1 represents a critical buffer overflow condition within the Diameter Rx Handler component, specifically affecting the pcrf_rx_aar_cb function in src/pcrf/pcrf-rx-path.c. This flaw manifests when processing the num_of_media_component and num_of_sub arguments, which are manipulated to exceed allocated buffer boundaries during diameter message processing. The attack vector is remote, meaning malicious actors can exploit this weakness without physical access to the system by sending specially crafted Diameter messages through the Rx interface. The vulnerability's severity is amplified by the availability of public exploits and the fact that it affects core network functions within 5G core networks, where Open5GS serves as a software-defined implementation.
The technical execution of this buffer overflow occurs during the processing of AAR (Authorization Answer) messages in the Diameter protocol, where the number of media components and subcomponents are parsed from incoming requests. When these values exceed expected boundaries, they overwrite adjacent memory locations, potentially leading to arbitrary code execution or denial of service conditions. The vulnerability directly corresponds to CWE-121 Stack-based Buffer Overflow, which is classified as a critical weakness in the Common Weakness Enumeration catalog. This type of buffer overflow represents a fundamental flaw in input validation and memory management practices within the software's networking stack.
The operational impact of this vulnerability extends beyond simple service disruption to potentially compromise entire 5G network security infrastructures. As the Diameter Rx interface handles policy control and charging functions for 5G networks, exploitation could allow attackers to manipulate subscriber billing data, bypass access controls, or gain unauthorized network privileges. Network operators relying on Open5GS for their core network implementations face significant risk of service degradation or complete system compromise, particularly given that this vulnerability affects the policy control function that governs network resource allocation and user authentication. The attack surface is further expanded by the publicly available exploit code, which reduces the barrier to successful exploitation.
Mitigation efforts should prioritize immediate upgrade to version 2.7.2, which incorporates the patch identified by commit hash 87b4e4535c77ded627cdb6f4e4e2e3ea761f40b7. This update addresses the core buffer overflow issue through proper input validation and memory boundary checks in the argument processing logic. Additionally, network administrators should implement monitoring for anomalous Diameter traffic patterns that might indicate exploitation attempts, particularly focusing on unusual values in media component counts within Rx interface messages. The remediation aligns with ATT&CK technique T1059.007 for Command and Scripting Interpreter: PowerShell, though the actual exploitation occurs at the network protocol level rather than through command execution. Organizations should also consider implementing network segmentation and access controls to limit exposure of the affected Open5GS components while applying the security patches.