CVE-2026-75438 in Open5GS
Summary
by MITRE • 09/04/2026
Buffer Overflow vulnerability in Open5GS v2.7.7 allows a remote attacker to cause a denial of service via the ogs_sbi_time_parse() function
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/04/2026
The identified vulnerability resides within the Open5GS core network implementation, specifically affecting version 2.7.7 and potentially earlier releases that share the same codebase architecture. This security flaw is classified as a buffer overflow condition located in the ogs_sbi_time_parse() function, which is responsible for parsing time-related fields within Service Based Interface (SBI) messages. The SBI is a critical component of 5G core networks, facilitating communication between network functions using HTTP/2 protocols based on OpenAPI specifications. When this function processes incoming requests, it fails to adequately validate the length or structure of input data before copying it into fixed-size buffers. This lack of rigorous bounds checking creates an opportunity for exploitation by remote attackers who can craft maliciously formatted SBI messages containing oversized time fields.
From a technical perspective, the vulnerability stems from improper memory management practices during string parsing operations. The ogs_sbi_time_parse() function likely utilizes standard C library functions or custom logic that does not verify whether the source data fits within the destination buffer's allocated space. When an attacker submits a request with a time field exceeding the expected maximum length, the excess data overwrites adjacent memory locations on the stack or heap. This memory corruption can lead to immediate application crashes due to segmentation faults, resulting in a denial of service against the affected network function. In more sophisticated exploitation scenarios, if specific conditions are met regarding memory layout and available gadgets, this overflow could potentially be leveraged for arbitrary code execution, although the primary reported impact is system instability and service interruption.
The operational impact of this vulnerability is significant within 5G infrastructure environments where Open5GS serves as a software-defined core network solution. A successful exploitation allows an unauthenticated remote attacker to disrupt critical telecommunications services by causing the affected Network Function to crash or become unresponsive. This denial of service can lead to call drops, failure in session establishment for user equipment, and interruption of signaling flows essential for mobility management and policy control. Since SBI endpoints are often exposed to internal network segments that may not be strictly firewalled against all potential attack vectors from compromised devices or malicious insiders, the risk surface is substantial. The availability of such a vulnerability undermines the reliability and resilience goals inherent in 5G architecture designs.
This flaw aligns with Common Weakness Enumeration (CWE) category CWE-120, which describes Buffer Copy without Checking Size of Input, indicating that the developer did not ensure sufficient space was available for the input data before performing the copy operation. Furthermore, from a tactical perspective related to the MITRE ATT&CK framework, this vulnerability facilitates Initial Access or Impact categories depending on whether it is used merely to crash services (Impact) or if further exploitation leads to code execution (Initial Access via Exploitation of Remote Services). The attack vector is classified as Network-based and requires no user interaction, making it a high-severity remote exploit.
Mitigation strategies should prioritize immediate patching to the latest stable version of Open5GS where this issue has been addressed by implementing strict input validation within the ogs_sbi_time_parse() function. Developers must ensure that all string inputs are checked against predefined maximum lengths before being processed or copied into buffers. Additionally, deploying network-level controls such as Web Application Firewalls (WAF) configured to detect anomalous HTTP/2 request sizes can provide a layer of defense in depth. It is also recommended to enable comprehensive logging and monitoring for SBI traffic patterns that deviate from normal behavior, allowing security operations teams to identify potential exploitation attempts in real-time. Regular code audits focusing on memory safety in C-based network applications are essential to prevent similar buffer overflow vulnerabilities in future releases.