# CVE-2026-90707: Open5GS use-after-free in AMF discovery fallback

Source: https://junglewise.ai/threats/cve-2026-90707-open5gs-use-after-free-in-amf-discovery-fallback  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-14. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-90707 · Severity: high · CVSS 8.3 · Published 2026-09-14

Open5GS is an open-source implementation of 5G core network infrastructure. A use-after-free vulnerability in the AMF (Access and Mobility Management Function) discovery fallback mechanism allows remote attackers to crash the service or potentially execute arbitrary code, impacting the availability and integrity of the 5G network core.

Technologies: [Open5GS](https://junglewise.ai/threats/technologies/open5gs). Vendors: [Open5GS](https://junglewise.ai/threats/vendors/open5gs).

## Quick answers

**Is CVE-2026-90707 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-90707 being exploited in the wild.

**How severe is CVE-2026-90707?** High severity, with a CVSS score of 8.3, published 14 September 2026.

**Which products and versions are affected?** Open5GS up to 2.7.x.

**Is there a fix for CVE-2026-90707?** A patch was published on 2026-09-14: Patch identified as commit ddd683a35f8aaac2b7b9884a24cd53bddfc65238 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-90707 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-90707?** Check whether you run Open5GS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a use-after-free flaw in the amf_nnrf_try_old_amf_discovery_fallback function (src/amf/nnrf-handler.c) that occurs when the discovery_option argument is manipulated. The root cause is premature deallocation of memory referenced in the SBI transaction context before it is passed to the fallback discovery helper. An attacker can trigger this condition remotely through crafted network discovery requests, leading to memory corruption. The patch (commit ddd683a) snapshots the GUAMI presence flag before transaction cleanup to prevent the use-after-free.

## Affected products

- Open5GS Open5GS up to 2.7.x

## Timeline

- 2026-09-14: disclosed
- 2026-09-14: patched: Patch identified as commit ddd683a35f8aaac2b7b9884a24cd53bddfc65238

## References

- [https://github.com/open5gs/open5gs/](https://github.com/open5gs/open5gs/)
- [https://github.com/open5gs/open5gs/commit/ddd683a35f8aaac2b7b9884a24cd53bddfc65238](https://github.com/open5gs/open5gs/commit/ddd683a35f8aaac2b7b9884a24cd53bddfc65238)

## Related threats

- [Open5GS HTTP/2 SBI server memory exhaustion](https://junglewise.ai/threats/cve-2026-106806-a-memory-exhaustion-issue-exists-in-open5gs-v2-8-0-in-the-http-2)
- [open5GS PFCP transaction handling denial of service](https://junglewise.ai/threats/cve-2026-106807-a-denial-of-service-vulnerability-exists-in-open5gs-v2-8-0-in)
- [Open5GS heap out-of-bounds write in multipart parsing](https://junglewise.ai/threats/cve-2026-116543-open5gs-1-3-0-through-2-8-0-contains-a-heap-out-of-bounds-write)
- [Open5GS assertion failure in SGSN context request handling](https://junglewise.ai/threats/cve-2026-108105-open5gs-through-2-8-0-contains-a-reachable-assertion)
- [Open5GS heap out-of-bounds read in PFCP parsing](https://junglewise.ai/threats/cve-2026-108103-open5gs-through-2-8-0-contains-a-heap-out-of-bounds-read)