CVE-2026-78157

A vulnerability was detected in Open5GS 2.8.0. This affects the function pcrf_rx_aar_cb of the file src/pcrf/pcrf-rx-path.c of the component Rx AA-Request Handler. Performing a manipulation results in out-of-bounds read. It is possible to initiate the attack remotely. The patch is named c18dc6938bf63cc7374315d3dca303d92066e746. To fix this issue, it is recommended to deploy a patch.

CVSS v3 7.4 HIGH
CVSS v2.0 6.5 MEDIUM

7.4^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.1 / Impact : 3.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope CHANGED

6.5^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 8.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://github.com/open5gs/open5gs/
https://github.com/open5gs/open5gs/commit/c18dc6938bf63cc7374315d3dca303d92066e746
https://github.com/open5gs/open5gs/issues/4663
https://vuldb.com/cve/CVE-2026-78157
https://vuldb.com/submit/882953
https://vuldb.com/vuln/394540
https://vuldb.com/vuln/394540/cti
https://github.com/open5gs/open5gs/issues/4663

Configurations

No configuration.

History

14 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) Se detectó una vulnerabilidad en Open5GS 2.8.0. Esto afecta a la función pcrf_rx_aar_cb del archivo src/pcrf/pcrf-rx-path.c del componente Gestor de Solicitudes AA de Rx. Realizar una manipulación resulta en una lectura fuera de límites. Es posible iniciar el ataque de forma remota. El parche se denomina c18dc6938bf63cc7374315d3dca303d92066e746. Para solucionar este problema, se recomienda desplegar un parche.

Information

Published : 2026-08-24 01:16

Updated : 2026-10-14 13:10

NVD link : CVE-2026-78157

Mitre link : CVE-2026-78157

CVE.ORG link : CVE-2026-78157

JSON object : View

Products Affected

No product.

CWE

CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE-125

Out-of-bounds Read

{"id": "CVE-2026-78157", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-78157", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-24T18:05:46.230530Z"}}], "cvssMetricV2": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"version": "2.0", "baseScore": 6.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 3.7, "exploitabilityScore": 3.1}], "cvssMetricV40": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cna@vuldb.com", "affectedData": [{"cpes": ["cpe:2.3:a:open5gs:open5gs:*:*:*:*:*:*:*:*"], "vendor": "n/a", "modules": ["Rx AA-Request Handler"], "product": "Open5GS", "versions": [{"status": "affected", "version": "2.8.0"}]}]}], "published": "2026-08-24T01:16:56.817", "references": [{"url": "https://github.com/open5gs/open5gs/", "source": "cna@vuldb.com"}, {"url": "https://github.com/open5gs/open5gs/commit/c18dc6938bf63cc7374315d3dca303d92066e746", "source": "cna@vuldb.com"}, {"url": "https://github.com/open5gs/open5gs/issues/4663", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/cve/CVE-2026-78157", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/submit/882953", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/vuln/394540", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/vuln/394540/cti", "source": "cna@vuldb.com"}, {"url": "https://github.com/open5gs/open5gs/issues/4663", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cna@vuldb.com", "description": [{"lang": "en", "value": "CWE-119"}, {"lang": "en", "value": "CWE-125"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in Open5GS 2.8.0. This affects the function pcrf_rx_aar_cb of the file src/pcrf/pcrf-rx-path.c of the component Rx AA-Request Handler. Performing a manipulation results in out-of-bounds read. It is possible to initiate the attack remotely. The patch is named c18dc6938bf63cc7374315d3dca303d92066e746. To fix this issue, it is recommended to deploy a patch."}, {"lang": "es", "value": "Se detect\u00f3 una vulnerabilidad en Open5GS 2.8.0. Esto afecta a la funci\u00f3n pcrf_rx_aar_cb del archivo src/pcrf/pcrf-rx-path.c del componente Gestor de Solicitudes AA de Rx. Realizar una manipulaci\u00f3n resulta en una lectura fuera de l\u00edmites. Es posible iniciar el ataque de forma remota. El parche se denomina c18dc6938bf63cc7374315d3dca303d92066e746. Para solucionar este problema, se recomienda desplegar un parche."}], "lastModified": "2026-10-14T13:10:00.187", "sourceIdentifier": "cna@vuldb.com"}