Quick answers
- Is CVE-2026-82589 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-82589 being exploited in the wild.
- How severe is CVE-2026-82589?
- Medium severity, with a CVSS score of 4.3, published 30 August 2026.
- Which products and versions are affected?
- Open5GS up to 2.7.7.
- Is there a fix for CVE-2026-82589?
- A patch was published on 2026-05-14: Patch released in version 2.8.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-82589 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-82589?
- Check whether you run Open5GS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This is a null pointer dereference or crash vulnerability in the amf_namf_comm_handle_n1_n2_message_transfer function within src/amf/namf-handler.c. The vulnerability exists in the N1-N2 Message Handler component and is triggered by manipulating the N1N2MessageTransferReqData.n2InfoContainer.smInfo.n2InfoContent.ngapIeType argument with an unsupported or out-of-range value. The attack is remotely exploitable and requires sending a malformed message; no authentication is required. An attacker can cause the AMF process to crash, resulting in denial of service for mobile subscribers. The fix was released in version 2.8.0 (commit abf8a836564b966b5141110fc25ed413c4f17522) which replaces an assert_if_reached call with proper error handling.
Affected products
- Open5GS Open5GS up to 2.7.7
Timeline
- 2026-08-30: disclosed
- 2026-05-14: patched: Patch released in version 2.8.0