Description

A vulnerability was identified in Open5GS up to 2.7.1. This issue affects the function pcrf_rx_aar_cb of the file src/pcrf/pcrf-rx-path.c of the component Diameter Rx Handler. The manipulation of the argument num_of_media_component/num_of_sub leads to buffer overflow. The attack can be initiated remotely. The exploit is publicly available and might be used. Upgrading to version 2.7.2 is capable of addressing this issue. The identifier of the patch is 87b4e4535c77ded627cdb6f4e4e2e3ea761f40b7. It is recommended to upgrade the affected component.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-12T01:17:06.207Z",
  "pubdate": "2026-08-12T01:17:06.207Z",
  "executiveSummary": "A buffer overflow vulnerability has been identified in Open5GS up to version 2.7.1, specifically within the Diameter Rx Handler component. The vulnerability resides in the pcrf_rx_aar_cb function located in src/pcrf/pcrf-rx-path.c. The flaw is triggered by improper handling and manipulation of the num_of_media_component and num_of_sub arguments during message processing. This security defect exposes the application to remote exploitation by unauthenticated threat actors over the network. Successful exploitation of this vulnerability can lead to memory corruption, potential remote code execution, or denial of service conditions against the Policy and Charging Rules Function (PCRF) component. Given that a public exploit is available, the risk level is considered critical. Immediate remediation is required to prevent unauthorized system compromise.",
  "technicalDetails": "The vulnerability is a classic buffer overflow flaw stemming from the insecure processing of Diameter Rx protocol messages within the Open5GS PCRF component. Specifically, the execution flow involves the pcrf_rx_aar_cb function in src/pcrf/pcrf-rx-path.c, which parses incoming Authentication-Authorization-Request (AAR) messages. The root cause lies in the lack of adequate bounds checking and validation on the num_of_media_component and num_of_sub arguments supplied within the network payload. When an attacker supplies maliciously crafted or excessively large values for these fields, the internal buffer allocation calculations fail to account for the actual data volume, resulting in a heap or stack-based buffer overflow when memory copy operations are performed. The attack can be initiated remotely over the network without requiring prior authentication or user interaction, as the Diameter Rx interface processes incoming sessions from remote Application Functions (AFs). Payload behavior during exploitation typically involves overwriting adjacent memory regions, which can corrupt critical application state data, crash the daemon process, or potentially allow the execution of arbitrary shellcode injected into the memory space under the privileges of the running Open5GS process. Post-exploitation impact includes complete service disruption of the core network policy management functionality, potential lateral movement, or unauthorized access depending on the execution context of the daemon. The vulnerability affects Open5GS versions up to 2.7.1 and is officially resolved in version 2.7.2 via patch identifier 87b4e4535c77ded627cdb6f4e4e2e3ea761f40b7."
}