CVE-2026-8186
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
Open5GS versions up to 2.7.7 contain an out-of-bounds read vulnerability in the function ogs_sbi_client_send_via_scp_or_sepp in the library lib/sbi/client.c in the NF component. An attacker can remotely manipulate data, leading to out-of-bounds read.
Risk Assessment
An attacker can remotely read out-of-bounds memory, potentially leading to information disclosure or process crash.
Recommendation
Apply the patch identified as d5bc487fcf9ea87d2b03f2ef95123af344773bfb or upgrade Open5GS to a version newer than 2.7.7.
Original NVD description (English source)
A vulnerability was detected in Open5GS up to 2.7.7. This affects the function ogs_sbi_client_send_via_scp_or_sepp in the library lib/sbi/client.c of the component NF. Performing a manipulation results in out-of-bounds read. The attack is possible to be carried out remotely. The patch is named d5bc487fcf9ea87d2b03f2ef95123af344773bfb. It is suggested to install a patch to address this issue.