Description

A vulnerability was determined in Open5GS up to 2.7.1. This vulnerability affects the function mme_s6a_subscription_data_from_avp of the file src/mme/mme-fd-path.c of the component Diameter S6a Interface. Executing a manipulation of the argument msisdn_len can lead to heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2.7.2 is able to resolve this issue. This patch is called 7ea82cb87bb65c3694d8d7c7a5efed1c4d3c9304. Upgrading the affected component is recommended.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-12T00:17:11.410Z",
  "pubdate": "2026-08-12T00:17:11.410Z",
  "executiveSummary": "A heap-based buffer overflow vulnerability has been identified in Open5GS up to version 2.7.1, specifically within the Diameter S6a Interface component. The flaw arises from improper handling of the msisdn_len argument inside the mme_s6a_subscription_data_from_avp function located in src/mme/mme-fd-path.c.\nSuccessful exploitation of this vulnerability can allow a remote attacker to trigger a heap-based buffer overflow, potentially leading to denial of service or arbitrary code execution within the context of the affected MME process. The vulnerability poses significant risk as exploits have been publicly disclosed and can be executed remotely across network boundaries without requiring prior authentication.\nOrganizations utilizing vulnerable deployments of Open5GS must prioritize remediation to eliminate potential remote exploitation vectors targeting core network signaling interfaces.",
  "technicalDetails": "The vulnerability is a heap-based buffer overflow residing in the mme_s6a_subscription_data_from_avp function of the file src/mme/mme-fd-path.c, which processes messages within the Diameter S6a Interface component of Open5GS.\nThe root cause of the vulnerability stems from insufficient bounds checking and input validation applied to the msisdn_len parameter when parsing subscription data attributes and Attribute Value Pairs (AVPs) received via the S6a protocol from a Diameter peer, such as a Home Subscriber Server (HSS).\nAn unauthenticated or remote attacker capable of interacting with the Diameter S6a interface can craft and transmit a malicious Diameter message containing a manipulated msisdn_len value. When the vulnerable function processes this malformed attribute, the allocated heap buffer size fails to accommodate the incoming data length, resulting in an out-of-bounds memory write on the heap.\nThe attack flow proceeds as follows: 1) The attacker transmits a crafted Diameter S6a message to the target Open5GS Mobility Management Entity (MME). 2) The MME receives the message and invokes the mme_s6a_subscription_data_from_avp function to extract subscription data. 3) The function reads the manipulated msisdn_len argument. 4) Memory allocation calculations fail to safely bound the incoming payload, causing data to overflow the designated heap buffer boundary. 5) This memory corruption leads to application instability, daemon crash resulting in denial of service, or potentially the execution of arbitrary shell code if memory layouts are successfully manipulated.\nThe affected component is the Diameter S6a Interface in Open5GS versions up to and including 2.7.1. The vulnerability is network-exposed, requires no authentication or special privileges to trigger remotely, and poses severe post-exploitation risks to core network availability and integrity."
}