{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-78157/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.4,"id":"CVE-2026-78157"}],"_cs_exploited":true,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Open5GS (2.8.0)"],"_cs_severities":["high"],"_cs_tags":["cve-2026-78157","denial-of-service","memory-corruption"],"_cs_type":"threat","_cs_vendors":[],"content_html":"\u003cp\u003eA memory safety vulnerability has been identified in Open5GS 2.8.0, specifically within the Rx AA-Request Handler component. The vulnerability is located in the \u003ccode\u003epcrf_rx_aar_cb\u003c/code\u003e function within \u003ccode\u003esrc/pcrf/pcrf-rx-path.c\u003c/code\u003e. An unauthenticated remote attacker can trigger this vulnerability by sending a maliciously crafted AA-Request (AAR) packet to the PCRF (Policy and Charging Rules Function) interface. Successful exploitation results in an out-of-bounds memory read, which can be leveraged to crash the service, leading to a denial-of-service condition, or potentially leak sensitive information from the process memory. The vendor has released a patch in commit \u003ccode\u003ec18dc6938bf63cc7374315d3dca303d92066e746\u003c/code\u003e. Organizations running Open5GS 2.8.0 should prioritize updating to the patched version.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker identifies an internet-facing or reachable Open5GS PCRF interface.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a malicious Diameter AA-Request (AAR) packet.\u003c/li\u003e\n\u003cli\u003eThe attacker transmits the packet to the PCRF component.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003epcrf_rx_aar_cb\u003c/code\u003e function processes the incoming AAR request.\u003c/li\u003e\n\u003cli\u003eThe function fails to properly validate memory bounds during the packet parsing process.\u003c/li\u003e\n\u003cli\u003eAn out-of-bounds read occurs, accessing memory outside the intended buffer.\u003c/li\u003e\n\u003cli\u003eThe application encounters a memory error or continues execution using corrupted data.\u003c/li\u003e\n\u003cli\u003eThe service crashes or discloses memory contents to the attacker.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability in an Open5GS deployment could lead to a localized denial of service for the core network control plane or the unauthorized exposure of process memory contents. Given that Open5GS is a critical component for 5G core network operations, such disruptions can impact network availability and subscriber connectivity.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade all instances of Open5GS 2.8.0 to a patched version using the fix provided in commit \u003ccode\u003ec18dc6938bf63cc7374315d3dca303d92066e746\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eImplement network-level access control lists (ACLs) to restrict access to the PCRF interface to trusted entities only.\u003c/li\u003e\n\u003cli\u003eMonitor logs for repeated service restarts of the Open5GS PCRF component which may indicate active exploitation attempts.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-24T01:40:24Z","date_published":"2026-08-24T01:40:24Z","id":"https://feed.craftedsignal.io/briefs/2026-08-open5gs-oob-read/","summary":"Open5GS 2.8.0 contains an out-of-bounds read vulnerability in the pcrf_rx_aar_cb function that allows a remote attacker to potentially cause a service crash or information disclosure.","title":"Out-of-Bounds Read in Open5GS Rx AA-Request Handler","url":"https://feed.craftedsignal.io/briefs/2026-08-open5gs-oob-read/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-78157","version":"https://jsonfeed.org/version/1.1"}