CVE-2026-108102 in Open5GS
Summary
by MITRE • 10/09/2026
Open5GS through 2.8.0 contains a heap out-of-bounds read vulnerability in ogs_pfcp_parse_volume_measurement() in lib/pfcp/types.c that allows remote unauthenticated attackers to read past IE buffers. Attackers can send a PFCP Session Report Request to the SMF on UDP port 8805 with a short, all-flags Volume Measurement IE, reading up to 48 bytes and potentially crashing the SMF.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/09/2026
The vulnerability identified in Open5GS versions through 2.8.0 represents a critical heap-based out-of-bounds read flaw located within the PFCP protocol handling logic. Specifically, the defect resides in the ogs_pfcp_parse_volume_measurement function found in the lib/pfcp/types.c source file. This component is responsible for parsing Volume Measurement Information Elements (IEs) received during Packet Forwarding Control Protocol sessions. The core technical issue stems from insufficient validation of input data length relative to buffer boundaries. When a malformed or specifically crafted PFCP message containing a short Volume Measurement IE with all flags set is processed, the parser fails to correctly account for the actual size of the payload against the expected structure size. This miscalculation leads the application to read memory locations beyond the allocated buffer limits.
From an operational perspective, this vulnerability allows remote unauthenticated attackers to interact directly with the Session Management Function (SMF) over UDP port 8805 without requiring any prior authentication credentials. The attacker can exploit this by sending a specially constructed PFCP Session Report Request message designed to trigger the out-of-bounds read condition. Upon processing such a request, the SMF may attempt to access up to forty-eight bytes of memory that lie outside the intended buffer boundaries. This behavior not only compromises data confidentiality by potentially leaking sensitive internal state information or cryptographic keys stored in adjacent heap regions but also introduces significant stability risks. The most immediate and observable impact is the potential crash of the SMF process, leading to a denial of service condition for all connected User Plane Functions and end-user sessions dependent on that specific control plane instance.
This vulnerability aligns with Common Weakness Enumeration category CWE-125, which describes out-of-bounds read conditions where software reads data past the end or before the beginning of the intended buffer. In terms of offensive security frameworks, this exploit scenario maps to MITRE ATT&CK technique T1078, specifically valid accounts if authentication were required, but more accurately reflects unauthorized access vectors often associated with initial exploitation phases in network infrastructure attacks. The ability to crash a core 5G control plane function like the SMF highlights the severity of improper input validation in critical telecommunications software components that handle high-volume signaling traffic.
Mitigation strategies for this vulnerability primarily involve upgrading Open5GS to version 2.8.1 or later, where the parsing logic has been corrected to enforce strict bounds checking on all incoming PFCP Information Elements. For environments unable to immediately patch, network-level controls such as firewall rules restricting access to UDP port 8805 should be implemented to limit exposure only to trusted User Plane Function IP addresses. Additionally, deploying intrusion detection systems capable of identifying anomalous PFCP message structures can provide an additional layer of defense against exploitation attempts targeting this specific heap overflow condition in legacy deployments.