Executive brief
Open5GS is an open-source implementation of 5G core network infrastructure. A use-after-free vulnerability in the AMF (Access and Mobility Management Function) discovery fallback mechanism allows remote attackers to crash the service or potentially execute arbitrary code, impacting the availability and integrity of the 5G network core.
Technical details
The vulnerability is a use-after-free flaw in the amf_nnrf_try_old_amf_discovery_fallback function (src/amf/nnrf-handler.c) that occurs when the discovery_option argument is manipulated. The root cause is premature deallocation of memory referenced in the SBI transaction context before it is passed to the fallback discovery helper. An attacker can trigger this condition remotely through crafted network discovery requests, leading to memory corruption. The patch (commit ddd683a) snapshots the GUAMI presence flag before transaction cleanup to prevent the use-after-free.
Affected products
- Open5GS Open5GS up to 2.7.x
Timeline
- 2026-09-14: disclosed
- 2026-09-14: patched: Patch identified as commit ddd683a35f8aaac2b7b9884a24cd53bddfc65238