Description

A vulnerability was determined in Linux Foundation Magma 1.9.0. The impacted element is an unknown function of the component InitialUEMessage Handler. This manipulation causes information disclosure. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-30T15:16:44.417Z",
  "pubdate": "2026-08-30T15:16:44.417Z",
  "executiveSummary": "A critical information disclosure vulnerability has been identified within the InitialUEMessage Handler component of Linux Foundation Magma version 1.9.0.\nThis vulnerability allows a remote, unauthenticated attacker to extract sensitive information by manipulating specific functions within the component.\nThe vulnerability resides in the core packet processing logic of the InitialUEMessage handler, which is a pivotal part of the 5G/LTE access stratum signaling.\nThe risk implication is significant as the exposure of system internal data or UE-specific information could lead to further exploitation, privacy violations, or system-wide reconnaissance.\nThe attack is remote and exploit code has been publicly disclosed, increasing the likelihood of active exploitation.\nUsers and administrators of Magma 1.9.0 are at high risk, as no complex prerequisites are required for the exploitation process.",
  "technicalDetails": "The vulnerability is situated within the InitialUEMessage Handler of Linux Foundation Magma 1.9.0, a component responsible for parsing and processing the S1AP/NGAP InitialUEMessage signaling packets received from the Radio Access Network (RAN).\nThe root cause of the information disclosure stems from improper validation or insecure handling of incoming protocol data structures during the initial attachment or signaling phase.\nBy injecting malformed or specifically crafted InitialUEMessage packets, an attacker can trigger an unexpected execution path within the handler function.\nThis logical error forces the component to return or include memory contents, internal state variables, or sensitive subscriber information in subsequent signaling responses, such as Error Indications or subsequent NAS signaling encapsulation.\nThe exploitation flow initiates with the attacker transmitting a specially prepared InitialUEMessage via the S1/N1 interface. Because the handler lacks sufficient boundary checks or sanitization during the message decoding process, the malformed input triggers an internal state leak.\nThis behavior manifests as an information disclosure, where the system inadvertently reveals internal context or sensitive data packets to the sender.\nSince the vulnerability is exploitable remotely, any entity capable of establishing a connection to the access gateway or mobility management entity can potentially probe the system.\nThe impact is not limited to simple data leakage; the disclosed information may contain headers, session identifiers, or internal memory addresses that facilitate subsequent, more complex attacks such as session hijacking or denial-of-service conditions.\nThe lack of enforced authentication at the initial signaling layer implies that any actor capable of generating conformant protocol packets can trigger this vulnerability before the security mode command process is finalized."
}