CVE-2026-2522: Open5GS MME Component RCE Vulnerability

CVE-2026-2522 Overview

A memory corruption vulnerability has been identified in Open5GS versions up to 2.7.6 affecting the Mobility Management Entity (MME) component. The vulnerability exists in the file /src/mme/esm-build.c and can be exploited remotely without authentication. The exploit has been publicly disclosed, and while the project maintainers were notified through an issue report, no response has been received at the time of publication.

Critical Impact

Remote attackers can trigger memory corruption in the Open5GS MME component, potentially causing service disruption in 5G/LTE core network deployments.

Affected Products

• Open5GS versions up to and including 2.7.6
• Open5GS MME (Mobility Management Entity) component
• Deployments utilizing the /src/mme/esm-build.c functionality

Discovery Timeline

• 2026-02-16 - CVE-2026-2522 published to NVD
• 2026-02-18 - Last updated in NVD database

Technical Details for CVE-2026-2522

Vulnerability Analysis

This vulnerability is classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). The flaw resides in the EPS Session Management (ESM) build functionality within the MME component of Open5GS. The MME is a critical control-plane element in LTE networks responsible for handling signaling between user equipment and the core network.

The memory corruption issue can be triggered remotely over the network without requiring authentication or user interaction. While the availability impact is limited (causing potential service disruption), the vulnerability does not appear to directly compromise confidentiality or integrity of the affected system.

Root Cause

The root cause of this vulnerability stems from improper memory buffer operations in the esm-build.c file within the MME component. The code fails to properly validate or restrict operations within memory buffer boundaries, leading to potential memory corruption when processing malformed or specially crafted input. This type of vulnerability (CWE-119) typically occurs when software performs operations on a memory buffer without ensuring the operations stay within the allocated boundaries.

Attack Vector

The vulnerability can be exploited remotely over the network. An attacker does not require authentication or any special privileges to trigger the memory corruption. The attack complexity is low, meaning no specialized conditions or techniques are needed beyond network access to the vulnerable MME component. The publicly disclosed nature of this vulnerability increases the risk of exploitation attempts against unpatched Open5GS deployments.

The attack would target the MME's EPS Session Management functionality, potentially sending malformed signaling messages that trigger the memory corruption condition in the vulnerable code path.

Detection Methods for CVE-2026-2522

Indicators of Compromise

• Unexpected crashes or service restarts of the Open5GS MME process
• Abnormal memory usage patterns in the MME component
• Unusual or malformed signaling traffic targeting the MME interface
• Core dumps or segmentation fault logs from the mme process

Detection Strategies

• Monitor Open5GS MME logs for crash events and memory-related errors
• Implement network intrusion detection rules for anomalous LTE/5G signaling traffic
• Deploy application-level monitoring to detect unusual behavior in the ESM protocol handling
• Use memory debugging tools (e.g., AddressSanitizer) in development/staging environments to identify exploitation attempts

Monitoring Recommendations

• Enable verbose logging for the MME component to capture detailed session management events
• Configure alerting for MME process termination or restart events
• Monitor network traffic for reconnaissance or exploitation attempts targeting the MME control plane
• Review GitHub Issue #4283 for updated indicators and community reports

How to Mitigate CVE-2026-2522

Immediate Actions Required

• Assess all Open5GS deployments to identify instances running version 2.7.6 or earlier
• Implement network segmentation to limit access to the MME component from untrusted networks
• Monitor the Open5GS GitHub repository for security patches addressing this vulnerability
• Consider deploying additional network-level controls (firewalls, IDS/IPS) to filter malicious traffic

Patch Information

At the time of publication, no official patch has been released by the Open5GS project. The vulnerability was reported through GitHub Issue #4283, but the project maintainers have not yet responded. Organizations should monitor the Open5GS repository for updates and apply patches immediately upon availability.

Workarounds

• Restrict network access to the MME component using firewall rules to allow only trusted sources
• Deploy the MME behind a reverse proxy or security gateway that can filter malicious requests
• Consider temporarily isolating affected Open5GS instances from untrusted networks until a patch is available
• Implement rate limiting on signaling interfaces to reduce the impact of potential exploitation attempts

# Example: Restrict MME access using iptables
# Allow only trusted networks to access MME signaling ports
iptables -A INPUT -p sctp -s 10.0.0.0/8 --dport 36412 -j ACCEPT
iptables -A INPUT -p sctp --dport 36412 -j DROP

# Monitor MME process for crashes
journalctl -u open5gs-mmed -f --since "1 hour ago"