---
id: CVE-2026-116544
title: Open5GS 2.6.1 through 2.8.0 Out-of-Bounds Read via parse_scheme_output
summary: >-
  Open5GS 2.6.1 through 2.8.0 contains an out-of-bounds read vulnerability in
  parse_scheme_output() in lib/sbi/conv.c during SUCI de-concealment due to
  incomplete length validation. Remote unauthenticated UEs or SBI peers can
  submit a craf…
severity: low
cvss: 3.7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-125
vendor: open5gs
product: open5gs
affected:
  - open5gs >= 2.6.1 <= 2.8.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-26T15:38:05.412866Z'
published: '2026-10-26'
updated: '2026-10-26'
sourceUpdated: '2026-10-26T16:15:00.617Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-116544'
references:
  - url: 'https://github.com/open5gs/open5gs/security/advisories/GHSA-vp5f-rg8g-8p7j'
    label: GitHub Security Advisory (GHSA-vp5f-rg8g-8p7j)
  - url: >-
      https://github.com/open5gs/open5gs/commit/fdddcd5e3359703f0a945b308e64494a18a534f1
    label: Patch Commit
  - url: 'https://github.com/open5gs/open5gs/blob/v2.8.0/lib/sbi/conv.c#L39'
  - url: 'https://github.com/open5gs/open5gs'
  - url: >-
      https://www.vulncheck.com/advisories/open5gs-2.6.1-through-2.8.0-out-of-bounds-read-via-parse-scheme-output
    label: >-
      VulnCheck Advisory: Open5GS 2.6.1 through 2.8.0 Out-of-Bounds Read via
      parse_scheme_output
tags:
  - cve.org
ingestedAt: '2026-10-26T15:29:30.501Z'
---

## Overview

Open5GS 2.6.1 through 2.8.0 contains an out-of-bounds read vulnerability in parse_scheme_output() in lib/sbi/conv.c during SUCI de-concealment due to incomplete length validation. Remote unauthenticated UEs or SBI peers can submit a crafted SUCI with a 42-byte scheme output to a UDM, triggering a heap over-read past the buffer.

## Affected

- `open5gs >= 2.6.1 <= 2.8.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.