Vulnerability · Published Aug 24, 2026 · Assigned by VulDB

CVE-2026-78157Open5GS Rx AA-Request pcrf-rx-path.c pcrf_rx_aar_cb out-of-bounds

High 7.4

In plain English

A high-severity out-of-bounds read in Open5GS. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).

Severity (CVSS 3.1)7.4High

Exploit odds (30 days)0.3%top 79.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was detected in Open5GS 2.8.0. This affects the function pcrf_rx_aar_cb of the file src/pcrf/pcrf-rx-path.c of the component Rx AA-Request Handler. Performing a manipulation results in out-of-bounds read. It is possible to initiate the attack remotely. The patch is named c18dc6938bf63cc7374315d3dca303d92066e746. To fix this issue, it is recommended to deploy a patch.

Affected products (as reported)

Vendor	Product	Versions
n/a	Open5GS	2.8.0

Weakness: CWE-125, CWE-119 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L/E:P/RL:O/RC:C

References

VDB-394540 | Open5GS Rx AA-Request pcrf-rx-path.c pcrf_rx_aar_cb out-of-bounds vdb-entry, technical-description
VDB-394540 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
CVE-2026-78157 | CVE Analysis and Report third-party-advisory
Submit #882953 | Open5GS 2.8.0 Out-of-Bounds Read third-party-advisory
https://github.com/open5gs/open5gs/issues/4663 issue-tracking
https://github.com/open5gs/open5gs/commit/c18dc6938bf63cc7374315d3dca303d92066e746 patch
https://github.com/open5gs/open5gs/ product