Description

A vulnerability was determined in Open5GS up to 2.7.7. This vulnerability affects the function amf_namf_comm_decode_ue_mm_context_list of the file src/amf/namf-handler.c of the component AMF. This manipulation of the argument ueContext.mmContextList[*].allowedNssai causes memory corruption. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2.8.0 is able to resolve this issue. Patch name: abf8a836564b966b5141110fc25ed413c4f17522. It is recommended to upgrade the affected component.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-30T19:17:30.050Z",
  "pubdate": "2026-08-30T19:17:30.050Z",
  "executiveSummary": "A critical memory corruption vulnerability has been identified in the Open5GS AMF (Access and Mobility Management Function) component, specifically within the namf-handler.c file. This vulnerability, affecting versions up to 2.7.7, allows a remote, unauthenticated attacker to trigger memory corruption by supplying a malformed ueContext.mmContextList[*].allowedNssai argument during the communication decoding process.\nThe vulnerability resides in the function amf_namf_comm_decode_ue_mm_context_list. Successful exploitation can lead to instability of the AMF service, potential denial-of-service conditions, or potentially arbitrary code execution depending on the heap layout and the nature of the corruption. Because this vulnerability is remotely exploitable, it poses a significant risk to the integrity and availability of 5G core network operations. The public disclosure of the exploit increases the likelihood of malicious exploitation attempts. Organizations utilizing Open5GS versions prior to 2.8.0 are highly vulnerable and must prioritize remediation.",
  "technicalDetails": "The vulnerability is localized to the function amf_namf_comm_decode_ue_mm_context_list within the src/amf/namf-handler.c source file of the Open5GS AMF component. The root cause is an improper handling of the 'allowedNssai' data structure within the 'ueContext.mmContextList' array during the deserialization or decoding phase of NAMF (N-AMF) communications.\nWhen the AMF receives a message from an external entity (such as another network function or a UE acting via an intermediary), the decoding function attempts to parse the provided 'allowedNssai' information. Due to insufficient bounds checking or incorrect length validation during the processing of these nested list structures, the application writes data into heap-allocated memory buffers without verifying if the input size exceeds the allocated buffer capacity. This results in a heap-based buffer overflow condition.\nThe attack flow initiates with a remote actor transmitting a crafted NAMF message containing a malicious 'allowedNssai' field. When the 'amf_namf_comm_decode_ue_mm_context_list' function processes this payload, the logic fails to enforce constraints on the data being copied, causing memory corruption in the process heap space. By precisely controlling the size and content of the malicious input, an attacker may be able to overwrite adjacent memory structures, function pointers, or data objects.\nThe impact of this corruption is severe, potentially resulting in the immediate crash of the AMF service (Denial of Service), or theoretically, the hijacking of the execution flow if the corruption can be leveraged to redirect control to attacker-supplied shellcode or existing executable memory regions (ROP/JOP). As the vulnerability involves the core AMF handling logic, it is exposed to any network entity capable of communicating with the AMF over the Namf interface. No specific authentication is required to send the malicious packet, as the vulnerability is triggered during the early stages of message decoding. The affected versions include all releases up to and including 2.7.7. The issue is resolved in version 2.8.0, as indicated by the official patch commit identifier abf8a836564b966b5141110fc25ed413c4f17522, which likely implements the missing sanity checks or bounds validation on the 'allowedNssai' parameter."
}