CVE-2026-2521: Open5GS Memory Corruption RCE Vulnerability

CVE-2026-2521 Overview

CVE-2026-2521 is a memory corruption vulnerability affecting Open5GS versions up to 2.7.6. The flaw resides in the sgwc_s5c_handle_create_session_response function within the Serving Gateway Control Plane (SGW-C) component. Remote attackers can trigger the issue by sending crafted GTPv2-C Create Session Response messages to the SGW-C, leading to memory corruption [CWE-119]. A public exploit reportedly exists, and the Open5GS project has not yet responded to the issue report filed on its GitHub tracker. Open5GS is an open-source implementation of 5G Core and EPC, widely used in private 5G/LTE deployments and research environments.

Critical Impact
Remote, unauthenticated memory corruption in the SGW-C component can disrupt mobile core network availability for connected subscribers.

Affected Products

Open5GS versions up to and including 2.7.6
SGW-C component (sgwc_s5c_handle_create_session_response function)
Deployments exposing the S5-C interface to untrusted networks

Discovery Timeline

2026-02-15 - CVE-2026-2521 published to NVD
2026-02-18 - Last updated in NVD database

Technical Details for CVE-2026-2521

Vulnerability Analysis

The vulnerability exists in the SGW-C component of Open5GS, specifically in how sgwc_s5c_handle_create_session_response processes incoming GTPv2-C (GPRS Tunneling Protocol Control Plane) messages on the S5-C reference point. The S5-C interface connects the SGW-C to the Packet Data Network Gateway Control Plane (PGW-C) in EPC architectures.

The weakness is classified as [CWE-119] (Improper Restriction of Operations within the Bounds of a Memory Buffer). When the function processes a Create Session Response message, insufficient validation of message fields allows attacker-controlled data to corrupt adjacent memory regions. The result is process instability or potential control-flow influence within the SGW-C daemon.

Because the SGW-C is a control-plane component in a mobile core, disruption directly impacts session establishment for subscribers attached through affected gateways.

Root Cause

The root cause is improper bounds handling when parsing GTPv2-C Create Session Response Information Elements (IEs) inside sgwc_s5c_handle_create_session_response. The function does not adequately constrain operations against the underlying buffer, enabling out-of-bounds memory writes or reads when malformed or oversized fields are supplied by a peer.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker capable of delivering a crafted GTPv2-C Create Session Response packet to the SGW-C on the S5-C interface can trigger the condition. Exploitability depends on network exposure of the S5/S8 interfaces, which in well-segmented operator environments are isolated from external networks but may be reachable in lab, research, or misconfigured private 5G deployments.

No verified proof-of-concept code is published in the referenced advisories. Refer to the Open5GS Issue #4282 for technical discussion and the VulDB entry #346109 for additional context.

Detection Methods for CVE-2026-2521

Indicators of Compromise

Unexpected crashes, restarts, or segmentation faults in the open5gs-sgwcd process
Anomalous GTPv2-C Create Session Response messages on the S5-C interface containing malformed or oversized Information Elements
Loss of session establishment capability for subscribers traversing the affected SGW-C

Detection Strategies

Monitor SGW-C process health and core dump generation on hosts running Open5GS
Inspect GTPv2-C traffic on S5-C/S8-C interfaces for malformed Create Session Response messages using packet brokers or IDS signatures
Correlate SGW-C service restarts with inbound GTPv2-C peer activity to identify suspicious senders

Monitoring Recommendations

Enable verbose logging on the SGW-C and forward logs to a centralized analytics platform for anomaly detection
Track baseline GTPv2-C message rates and alert on volume spikes or unusual peer endpoints
Audit firewall and ACL configurations to confirm S5-C interfaces are reachable only by authorized PGW-C peers

How to Mitigate CVE-2026-2521

Immediate Actions Required

Restrict network access to the SGW-C S5-C interface so that only trusted PGW-C peers can communicate with it
Inventory all Open5GS deployments and identify instances running version 2.7.6 or earlier
Monitor the Open5GS GitHub repository for an upstream fix and apply it once published

Patch Information

At the time of NVD publication, no vendor patch is available. The project was notified through Open5GS Issue #4282 but has not yet responded. Operators should track the issue and apply updates as soon as a fixed release is published.

Workarounds

Place the SGW-C behind strict network segmentation, allowing GTPv2-C traffic only from authenticated, trusted PGW-C nodes
Deploy GTP-aware firewalls or signaling protection functions to filter malformed Create Session Response messages
Avoid exposing S5/S8 interfaces to lab, guest, or untrusted networks until a patch is released
Run the SGW-C with reduced privileges and resource limits to constrain the impact of a process crash

bash

# Example iptables rule restricting GTPv2-C (UDP/2123) to a trusted PGW-C peer
iptables -A INPUT -p udp --dport 2123 -s <trusted_pgwc_ip> -j ACCEPT
iptables -A INPUT -p udp --dport 2123 -j DROP