Description

A vulnerability was identified in Open5GS up to 2.7.7. This issue affects some unknown processing of the file src/amf/namf-handler.c of the component Transfer Endpoint. Such manipulation leads to null pointer dereference. The attack can be launched remotely. Upgrading to version 2.8.0 is capable of addressing this issue. The name of the patch is abf8a836564b966b5141110fc25ed413c4f17522. Upgrading the affected component is advised.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-30T22:17:00.847Z",
  "pubdate": "2026-08-30T22:17:00.847Z",
  "executiveSummary": "A Null Pointer Dereference vulnerability exists in the Open5GS AMF (Access and Mobility Management Function) component, specifically within the Transfer Endpoint handler defined in src/amf/namf-handler.c.\nThis vulnerability, present in all versions up to and including 2.7.7, allows a remote, unauthenticated attacker to trigger a crash in the AMF service.\nThe root cause is improper validation of input data during the processing of Transfer Endpoint requests, which leads the application to attempt an operation on a null pointer.\nSuccessful exploitation results in a Denial of Service (DoS) condition, rendering the 5G core network functionality unavailable for affected users.\nGiven that the AMF is a critical component of the 5G service-based architecture, the potential for service disruption is significant.\nThe vulnerability can be exploited remotely over the network without requiring prior authentication, necessitating an immediate upgrade to version 2.8.0 to resolve the underlying memory safety issue.",
  "technicalDetails": "The vulnerability resides in the src/amf/namf-handler.c source file within the Open5GS AMF component. The specific logic responsible for handling Transfer Endpoint requests fails to implement robust null pointer validation during the processing of incoming messages.\nWhen an attacker sends a specially crafted packet to the Transfer Endpoint, the AMF service performs operations that rely on a pointer that remains uninitialized or becomes null under specific, malformed input conditions.\nThe attack flow initiates with a remote attacker transmitting an crafted request directed at the AMF's exposed interface. Upon receiving this input, the application proceeds to access a pointer variable that has not been properly verified for a null state. The execution path follows a branch where the pointer is dereferenced to retrieve data or call a method, triggering a segmentation fault (SIGSEGV) at the processor level.\nBecause this error occurs within the core AMF process, the immediate impact is an unhandled exception that forces the termination of the service process. In a production 5G environment, this leads to the failure of AMF signaling, effectively severing the connection between user equipment (UE) and the core network. This behavior is reproducible remotely, as the endpoint responsible for processing these requests is network-accessible.\nThe vulnerability is identified by the patch commit abf8a836564b966b5141110fc25ed413c4f17522, which introduces the necessary bounds checking and null pointer validation. Prior to this fix, the code lacked the prerequisite conditional checks to ensure that the memory address being dereferenced was valid and pointed to an allocated memory structure.\nPost-exploitation, the primary impact is service unavailability. The AMF component may require a restart to recover, but as long as the attacker continues to send the malicious payload, the service will remain in a crash loop, effectively causing a permanent Denial of Service until the software is patched or the traffic is blocked at the network perimeter. No elevation of privilege is achieved via this specific vulnerability; it remains strictly a memory safety flaw resulting in application instability."
}