{"id":"CVE-2026-116544","title":"Open5GS 2.6.1 through 2.8.0 Out-of-Bounds Read via parse_scheme_output","summary":"Open5GS 2.6.1 through 2.8.0 contains an out-of-bounds read vulnerability in parse_scheme_output() in lib/sbi/conv.c during SUCI de-concealment due to incomplete length validation. Remote unauthenticated UEs or SBI peers can submit a craf…","severity":"low","cvss":3.7,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","cvssSource":"cna","cwe":["CWE-125"],"vendor":"open5gs","product":"open5gs","affected":["open5gs >= 2.6.1 <= 2.8.0"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-26T15:38:05.412866Z"},"published":"2026-10-26","updated":"2026-10-26","sourceUpdated":"2026-10-26T16:15:00.617Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-116544","references":[{"url":"https://github.com/open5gs/open5gs/security/advisories/GHSA-vp5f-rg8g-8p7j","label":"GitHub Security Advisory (GHSA-vp5f-rg8g-8p7j)"},{"url":"https://github.com/open5gs/open5gs/commit/fdddcd5e3359703f0a945b308e64494a18a534f1","label":"Patch Commit"},{"url":"https://github.com/open5gs/open5gs/blob/v2.8.0/lib/sbi/conv.c#L39"},{"url":"https://github.com/open5gs/open5gs"},{"url":"https://www.vulncheck.com/advisories/open5gs-2.6.1-through-2.8.0-out-of-bounds-read-via-parse-scheme-output","label":"VulnCheck Advisory: Open5GS 2.6.1 through 2.8.0 Out-of-Bounds Read via parse_scheme_output"}],"tags":["cve.org"],"ingestedAt":"2026-10-26T15:29:30.501Z","slug":"CVE-2026-116544","body":"## Overview\n\nOpen5GS 2.6.1 through 2.8.0 contains an out-of-bounds read vulnerability in parse_scheme_output() in lib/sbi/conv.c during SUCI de-concealment due to incomplete length validation. Remote unauthenticated UEs or SBI peers can submit a crafted SUCI with a 42-byte scheme output to a UDM, triggering a heap over-read past the buffer.\n\n## Affected\n\n- `open5gs >= 2.6.1 <= 2.8.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":20,"depthScoreParts":{"impact":20.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}