CVE-2026-10114: Open5GS Out-of-Bounds Write in NF Profile Parser

Technical summary

CVE-2026-10114 is an out-of-bounds write vulnerability in the handle_scp_info function within lib/sbi/nnrf-handler.c of Open5GS. The Shared NF-profile Parser component fails to validate buffer boundaries when processing network function profile data received over the network. This results in memory corruption that can be triggered by an authenticated attacker with network access. The vulnerability is classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-787 (Out-of-bounds Write).

Business impact

For telecom operators and enterprises deploying Open5GS, this vulnerability threatens service availability. A successful exploit causes denial of service by crashing the NF profile handling subsystem, potentially disrupting 5G network slicing and service registration workflows. Since the attack requires valid credentials, the risk is primarily from internal compromise, rogue infrastructure elements, or lateral movement within the network. Recovery requires service restart, impacting active subscribers and business continuity.

Affected systems

Open5GS up to version 2.7.7 is affected. Operators must verify their deployed version and determine if they operate the impacted component (Shared NF-profile Parser in the SBI layer). The vulnerability is remotely triggerable but requires authenticated access, limiting exposure to threat actors with network foothold within the telecom infrastructure or those who have compromised legitimate network credentials.

Exploitability

The exploit has been publicly disclosed, removing the complexity barrier for potential attackers. Exploitation requires network connectivity to the affected Open5GS instance and valid credentials (PR:L in CVSS vector). No user interaction is needed, and the attack can be executed remotely. The CVSS 3.1 score of 4.3 (Medium) reflects low confidentiality and integrity impact, but the public disclosure elevates practical risk despite the moderate base score.

Remediation

Deploy a patched version of Open5GS beyond 2.7.7 as recommended by the project maintainers. Verify the exact patch version number against the official Open5GS release notes and security advisories. In the interim, restrict network access to Open5GS management and SBI interfaces using firewall rules and VLANs to limit exposure to trusted infrastructure elements only.

Patch guidance

Apply the latest Open5GS patch that addresses CVE-2026-10114—verify against the official Open5GS security advisory and release notes for the specific version number. Test the patch in a pre-production environment to ensure compatibility with your network slicing configuration and connected NFs. Schedule the update during a maintenance window with rollback procedures in place. Document the patched version across all Open5GS deployments to maintain consistency.

Detection guidance

Monitor Open5GS logs and core dumps for segmentation faults or abnormal termination of the SBI handler process. Inspect network traffic to the NF-profile registration endpoint for malformed or oversized profile objects that could trigger the buffer overflow. Implement runtime memory protection tools (e.g., ASAN, valgrind) in staging environments to detect out-of-bounds writes during testing. Alert on unexpected service restarts or crashes in the NF discovery and registration subsystem.

Why prioritize this

Although the CVSS score is moderate (4.3), the combination of public exploit disclosure, denial-of-service impact, and the critical role of NF profile handling in 5G infrastructure justifies prompt patching. Telecom operators should prioritize this update to prevent opportunistic attacks from actors who now have exploitation techniques in hand.

Risk score, explained

CVSS 3.1 score of 4.3 (Medium) reflects the requirement for authenticated access (PR:L) and network proximity, which limits the attack surface. However, the score does not fully capture the public disclosure and availability of exploit code, which substantially increases practical risk. The out-of-bounds write causes only availability impact (A:L), not confidentiality or integrity violations, keeping the severity moderate rather than high.

Frequently asked questions