Description

A vulnerability was detected in Open5GS 2.8.0. This affects the function pcrf_rx_aar_cb of the file src/pcrf/pcrf-rx-path.c of the component Rx AA-Request Handler. Performing a manipulation results in out-of-bounds read. It is possible to initiate the attack remotely. The patch is named c18dc6938bf63cc7374315d3dca303d92066e746. To fix this issue, it is recommended to deploy a patch.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.4",
  "pubDate": "2026-08-24T01:16:56.817Z",
  "pubdate": "2026-08-24T01:16:56.817Z",
  "executiveSummary": "An out-of-bounds read vulnerability has been identified in Open5GS version 2.8.0, specifically within the Rx AA-Request Handler component. The flaw resides in the pcrf_rx_aar_cb function located in src/pcrf/pcrf-rx-path.c. This security defect allows a remote attacker to trigger an out-of-bounds read condition by manipulating specific inputs processed by the affected function. Successful exploitation of this vulnerability could lead to information disclosure or application instability, potentially impacting the availability and confidentiality of the 5G core network functions. The vulnerability can be exploited remotely over the network without requiring prior authentication or elevated privileges, depending on the exposure of the Rx interface. Risk implications include the unauthorized exposure of sensitive memory contents and denial of service via application crashes. Remediation requires applying the official software patch referenced by commit identifier c18dc6938bf63cc7374315d3dca303d92066e746.",
  "technicalDetails": "The vulnerability is classified as an out-of-bounds read, stemming from improper input validation and boundary checking within the Rx AA-Request Handler of Open5GS. The vulnerable component is the pcrf_rx_aar_cb function implemented in src/pcrf/pcrf-rx-path.c. The root cause lies in how the function parses and processes incoming Diameter AA-Request (AAR) messages over the Rx reference point. When an attacker crafts and transmits a malicious or malformed AAR payload containing unexpected attribute-value pairs (AVPs) or inconsistent length fields, the pcrf_rx_aar_cb function fails to properly validate the boundaries of the input buffer before reading data. Consequently, the application attempts to read memory locations outside the allocated bounds of the buffer. Exploitation occurs remotely over the network by sending a specially crafted Diameter message to the vulnerable Policy and Charging Rules Function (PCRF) interface. The attack flow begins with the remote transmission of the malicious packet to the exposed Rx service port. Upon receipt, the Open5GS control plane passes the payload to the PCRF message handling pipeline, where the flawed pcrf_rx_aar_cb function processes the input. The lack of rigorous bounds checking causes the pointer arithmetic or buffer indexing to traverse past the intended memory limits. The post-exploitation impact primarily involves unauthorized read access to adjacent memory regions, which can leak sensitive runtime data or trigger a segmentation fault, resulting in a denial of service condition for the PCRF service. The affected version is Open5GS 2.8.0, and the issue requires network access to the Rx interface but does not mandate authentication or specific user privileges."
}