CVE-2026-8267
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
Open5GS up to version 2.7.7 has a vulnerability in the smf_nsmf_handle_created_data_in_vsmf function of the SMF component, leading to denial of service (DoS). The attack can be remote. Exploit has been published.
Risk Assessment
An attacker can remotely crash the SMF component, disrupting 5G network operations.
Recommendation
Update Open5GS to a version above 2.7.7 once a patch is released.
Original NVD description (English source)
A flaw has been found in Open5GS up to 2.7.7. This vulnerability affects the function smf_nsmf_handle_created_data_in_vsmf of the component SMF. This manipulation causes denial of service. The attack may be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.