CVE-2026-116543

HIGH 7.5

Open5GS 1.3.0 through 2.8.0 Heap Out-of-Bounds Write via SBI Multipart Parser

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

0th

Open5GS 1.3.0 through 2.8.0 contains a heap out-of-bounds write vulnerability in parse_multipart() that allows unauthenticated attackers to corrupt memory by supplying an empty multipart boundary. Attackers can send a single crafted multipart/related request to the SBI interface of any network function, overflowing the lookbehind buffer and crashing it.

CWE	CWE-787
Vendor	open5gs
Product	open5gs
Published	Oct 26, 2026

Stay Ahead of the Next One

Get instant alerts for open5gs open5gs

Be the first to know when new high vulnerabilities affecting open5gs open5gs are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

open5gs / open5gs

1.3.0 ≤ 2.8.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/open5gs/open5gs/security/advisories/GHSA-25v2-v588-jq8g github.com: https://github.com/open5gs/open5gs/commit/6820c2743b5b5e126e3755d2f92dae2b236732df github.com: https://github.com/open5gs/open5gs/blob/v2.8.0/lib/sbi/message.c#L3372 github.com: https://github.com/open5gs/open5gs/blob/v2.8.0/lib/sbi/contrib/multipart_parser.c#L260 github.com: https://github.com/open5gs/open5gs vulncheck.com: https://www.vulncheck.com/advisories/open5gs-1.3.0-through-2.8.0-heap-out-of-bounds-write-via-sbi-multipart-parser

Credits

Eun0us / Espilon VulnCheck