CVE-2026-116544: Open5GS 2.6.1 through 2.8.0 Out-of-Bounds Read via parse_scheme_output
Open5GS 2.6.1 through 2.8.0 contains an out-of-bounds read vulnerability in parseschemeoutput() in lib/sbi/conv.c during SUCI de-concealment due to incomplete length validation. Remote unauthenticated UEs or SBI peers can submit a crafted SUCI with a 42-byte scheme output to a UDM, triggering a heap over-read past the buffer.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Open5GS versions 2.6.1 through 2.8.0 are affected when a UDM performs SUCI de-concealment. The crafted input may be supplied remotely by an unauthenticated UE or an SBI peer.
What is required to trigger the flaw?
An attacker needs to submit a crafted SUCI containing a 42-byte scheme output to the UDM. No authentication or user interaction is required, but the attack complexity is rated high.
What is the impact of successful exploitation?
The vulnerable parsing path performs a heap out-of-bounds read past the scheme-output buffer. The stated impact is limited to confidentiality, with no integrity or availability impact indicated.