CVE-2026-116544

Name of the Vulnerable Software and Affected Versions Open5GS versions 2.6.1 through 2.8.0

Description An out-of-bounds read exists in the parse scheme output() function within lib/sbi/conv.c during SUCI (Subscription Concealed Identifier) de-concealment. This issue stems from incomplete length validation, allowing remote unauthenticated UEs (User Equipment) or SBI (Service Based Interface) peers to submit a crafted SUCI with a 42-byte scheme output to a UDM (Unified Data Management), which triggers a heap over-read past the buffer.

Recommendations Update Open5GS to a version later than 2.8.0. As a temporary mitigation, restrict access to the UDM from untrusted SBI peers.