Quick answers
- Is CVE-2026-78156 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-78156 being exploited in the wild.
- How severe is CVE-2026-78156?
- High severity, with a CVSS score of 7.4, published 24 August 2026.
- Which products and versions are affected?
- Open5GS 2.8.0.
- Is there a fix for CVE-2026-78156?
- A patch was published on 2026-08-24: Patch commit a9c82ee0b590d76a581b0580cb46b598984e2392 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-78156 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-78156?
- Check whether you run Open5GS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A heap-based buffer overflow exists in the hss_ogs_diam_s6a_air_cb function in src/hss/hss-s6a-path.c, which processes Diameter Authentication-Information-Request (AIR) messages on the S6a interface. The vulnerability occurs because the function does not properly validate the length of the Visited-PLMN-Id AVP (Attribute-Value Pair) before using it in a memory operation, allowing an attacker to write beyond allocated buffer bounds. An attacker with network access to the S6a interface can remotely trigger this overflow by sending a malicious AIR message. The impact includes denial of service and potential code execution with HSS privileges. A patch (commit a9c82ee0b590d76a581b0580cb46b598984e2392) that adds length validation for the Visited-PLMN-Id field has been released.
Affected products
- Open5GS Open5GS 2.8.0
Timeline
- 2026-08-24: disclosed
- 2026-08-24: patched: Patch commit a9c82ee0b590d76a581b0580cb46b598984e2392