Open5GS: Heap out-of-bounds write in parse_multipart (CVE-2026-116543)
Open5GS versions 1.3.0 through 2.8.0 contain a heap out-of-bounds write vulnerability in the parse_multipart() function, allowing unauthenticated attackers to corrupt memory and crash network functions.
CVE search metadata
CVE search record: CVE-2026-116543. Severity: high. CVSS: 7.5. KEV: no. Product: Open5GS (1.3.0 through 2.8.0). Brief: Open5GS: Heap out-of-bounds write in parse_multipart (CVE-2026-116543). Brief link: https://feed.craftedsignal.io/briefs/2026-10-open5gs-heap-oob-write/
Triage facts
Revision 1- Applicability
- Open5GS (1.3.0 through 2.8.0)
- Evidence
- Unknown
- Severity
- Low
- Sources
- 1 public source
- Freshness
- Revision 1Oct 26, 17:44 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
A heap out-of-bounds write vulnerability exists in the parse_multipart() function of Open5GS versions 1.3.0 through 2.8.0. Unauthenticated attackers can exploit this by sending a crafted multipart/related request to the SBI interface of any network function. This triggers an overflow of the lookbehind buffer, resulting in memory corruption and a crash of the affected network function.