Vulnerability · Published Oct 26, 2026 · Assigned by VulnCheck
CVE-2026-116543Open5GS 1.3.0 through 2.8.0 Heap Out-of-Bounds Write via SBI Multipart Parser
High 7.5
In plain English
A high-severity out-of-bounds write in open5gs from open5gs. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.4%top 67.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Open5GS 1.3.0 through 2.8.0 contains a heap out-of-bounds write vulnerability in parse_multipart() that allows unauthenticated attackers to corrupt memory by supplying an empty multipart boundary. Attackers can send a single crafted multipart/related request to the SBI interface of any network function, overflowing the lookbehind buffer and crashing it.
Affected products (as reported)
Weakness: CWE-787 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- GitHub Security Advisory (GHSA-25v2-v588-jq8g) vendor-advisory
- Patch Commit patch
- https://github.com/open5gs/open5gs/blob/v2.8.0/lib/sbi/message.c#L3372 technical-description
- https://github.com/open5gs/open5gs/blob/v2.8.0/lib/sbi/contrib/multipart_parser.c#L260 technical-description
- https://github.com/open5gs/open5gs product
- VulnCheck Advisory: Open5GS 1.3.0 through 2.8.0 Heap Out-of-Bounds Write via SBI Multipart Parser third-party-advisory