Executive brief
Open5GS is a 5G core network implementation used in telecommunications infrastructure. A heap-based buffer overflow vulnerability in the Diameter S6a interface component allows remote attackers to manipulate the msisdn_len argument, potentially leading to memory corruption, service disruption, or code execution without requiring authentication.
Technical details
The vulnerability is a heap-based buffer overflow in the mme_s6a_subscription_data_from_avp function (file src/mme/mme-fd-path.c) of Open5GS's Diameter S6a interface component. The flaw results from improper validation of the msisdn_len argument when processing subscription data. An unauthenticated remote attacker can send a crafted Diameter message over the network to trigger the overflow. A patch (commit 7ea82cb87bb65c3694d8d7c7a5efed1c4d3c9304) resolving the issue is available in version 2.7.2 and later. The exploit has been publicly disclosed.
Affected products
- Open5GS Open5GS up to 2.7.1
Timeline
- 2026-08-12: disclosed: CVE-2024-14043 published
- 2026-08-12: patched: Fix available in version 2.7.2 and later (commit 7ea82cb87bb65c3694d8d7c7a5efed1c4d3c9304)