# CVE-2026-15720: Open5GS heap out-of-bounds read in AMF NAS 5GS handler

Source: https://junglewise.ai/threats/cve-2026-15720-open5gs-heap-out-of-bounds-read-in-amf-nas-5gs-handler  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-14. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2026-15720 · Severity: high · CVSS 8.6 · Published 2026-07-14

Open5GS is an open-source implementation of 5G Core and EPC mobile network functions. A vulnerability in how the Access and Mobility Management Function (AMF) handles mobile identity information allows an unauthenticated attacker to crash the core network service. This results in a total denial of service for all mobile subscribers and connected radio base stations served by the affected component.

Technologies: [Open5GS](https://junglewise.ai/threats/technologies/open5gs). Vendors: [Open5GS](https://junglewise.ai/threats/vendors/open5gs).

## Quick answers

**Is CVE-2026-15720 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-15720 being exploited in the wild.

**How severe is CVE-2026-15720?** High severity, with a CVSS score of 8.6, published 14 July 2026.

**Which products and versions are affected?** Open5GS <= 2.7.7.

**Is there a fix for CVE-2026-15720?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-15720 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-15720?** Check whether you run Open5GS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A heap out-of-bounds read exists in the `ogs_nas_5gs_decode_5gs_mobile_identity()` function within `lib/nas/5gs/ies.c`. The root cause is a failure to validate that the attacker-declared length of a mobile identity (GUTI or 5G-S-TMSI) is sufficient for the identity type specified. When the AMF processes a NAS Registration, Deregistration, or Service Request, it aliases a pointer into the packet buffer without a minimum-length check and subsequently casts it to a fixed-size struct. An attacker using a rogue base station (gNB) can send a malformed NAS message before authentication occurs, causing the AMF to read past the buffer boundary. In hardened or ASAN-enabled builds, this results in an immediate crash of the AMF process, dropping all active subscriber sessions.

## Affected products

- Open5GS Open5GS <= 2.7.7

## Timeline

- 2026-06-05: advisory: Vendor advisory published on GitHub
- 2026-07-14: disclosed: CVE published to NVD

## References

- [https://github.com/open5gs/open5gs/security/advisories/GHSA-f4mx-3x6p-cfwp](https://github.com/open5gs/open5gs/security/advisories/GHSA-f4mx-3x6p-cfwp)

## Related threats

- [Open5GS HTTP/2 SBI server memory exhaustion](https://junglewise.ai/threats/cve-2026-106806-a-memory-exhaustion-issue-exists-in-open5gs-v2-8-0-in-the-http-2)
- [open5GS PFCP transaction handling denial of service](https://junglewise.ai/threats/cve-2026-106807-a-denial-of-service-vulnerability-exists-in-open5gs-v2-8-0-in)
- [Open5GS heap out-of-bounds write in multipart parsing](https://junglewise.ai/threats/cve-2026-116543-open5gs-1-3-0-through-2-8-0-contains-a-heap-out-of-bounds-write)
- [Open5GS assertion failure in SGSN context request handling](https://junglewise.ai/threats/cve-2026-108105-open5gs-through-2-8-0-contains-a-reachable-assertion)
- [Open5GS heap out-of-bounds read in PFCP parsing](https://junglewise.ai/threats/cve-2026-108103-open5gs-through-2-8-0-contains-a-heap-out-of-bounds-read)