CVE-2026-2522: Open5GS MME Component RCE Vulnerability

CVE-2026-2522 Overview

A memory corruption vulnerability has been identified in Open5GS versions up to 2.7.6 affecting the Mobility Management Entity (MME) component. The vulnerability exists in the file /src/mme/esm-build.c and can be exploited remotely without authentication. The exploit has been publicly disclosed, and while the project maintainers were notified through an issue report, no response has been received at the time of publication.

Critical Impact
Remote attackers can trigger memory corruption in the Open5GS MME component, potentially causing service disruption in 5G/LTE core network deployments.

Affected Products

Open5GS versions up to and including 2.7.6
Open5GS MME (Mobility Management Entity) component
Deployments utilizing the /src/mme/esm-build.c functionality

Discovery Timeline

2026-02-16 - CVE-2026-2522 published to NVD
2026-02-18 - Last updated in NVD database

Technical Details for CVE-2026-2522

Vulnerability Analysis

This vulnerability is classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). The flaw resides in the EPS Session Management (ESM) build functionality within the MME component of Open5GS. The MME is a critical control-plane element in LTE networks responsible for handling signaling between user equipment and the core network.

The memory corruption issue can be triggered remotely over the network without requiring authentication or user interaction. While the availability impact is limited (causing potential service disruption), the vulnerability does not appear to directly compromise confidentiality or integrity of the affected system.

Root Cause

The root cause of this vulnerability stems from improper memory buffer operations in the esm-build.c file within the MME component. The code fails to properly validate or restrict operations within memory buffer boundaries, leading to potential memory corruption when processing malformed or specially crafted input. This type of vulnerability (CWE-119) typically occurs when software performs operations on a memory buffer without ensuring the operations stay within the allocated boundaries.

Attack Vector

The vulnerability can be exploited remotely over the network. An attacker does not require authentication or any special privileges to trigger the memory corruption. The attack complexity is low, meaning no specialized conditions or techniques are needed beyond network access to the vulnerable MME component. The publicly disclosed nature of this vulnerability increases the risk of exploitation attempts against unpatched Open5GS deployments.

The attack would target the MME's EPS Session Management functionality, potentially sending malformed signaling messages that trigger the memory corruption condition in the vulnerable code path.

Detection Methods for CVE-2026-2522

Indicators of Compromise

Unexpected crashes or service restarts of the Open5GS MME process
Abnormal memory usage patterns in the MME component
Unusual or malformed signaling traffic targeting the MME interface
Core dumps or segmentation fault logs from the mme process

Detection Strategies

Monitor Open5GS MME logs for crash events and memory-related errors
Implement network intrusion detection rules for anomalous LTE/5G signaling traffic
Deploy application-level monitoring to detect unusual behavior in the ESM protocol handling
Use memory debugging tools (e.g., AddressSanitizer) in development/staging environments to identify exploitation attempts

Monitoring Recommendations

Enable verbose logging for the MME component to capture detailed session management events
Configure alerting for MME process termination or restart events
Monitor network traffic for reconnaissance or exploitation attempts targeting the MME control plane
Review GitHub Issue #4283 for updated indicators and community reports

How to Mitigate CVE-2026-2522

Immediate Actions Required

Assess all Open5GS deployments to identify instances running version 2.7.6 or earlier
Implement network segmentation to limit access to the MME component from untrusted networks
Monitor the Open5GS GitHub repository for security patches addressing this vulnerability
Consider deploying additional network-level controls (firewalls, IDS/IPS) to filter malicious traffic

Patch Information

At the time of publication, no official patch has been released by the Open5GS project. The vulnerability was reported through GitHub Issue #4283, but the project maintainers have not yet responded. Organizations should monitor the Open5GS repository for updates and apply patches immediately upon availability.

Workarounds

Restrict network access to the MME component using firewall rules to allow only trusted sources
Deploy the MME behind a reverse proxy or security gateway that can filter malicious requests
Consider temporarily isolating affected Open5GS instances from untrusted networks until a patch is available
Implement rate limiting on signaling interfaces to reduce the impact of potential exploitation attempts

bash

# Example: Restrict MME access using iptables
# Allow only trusted networks to access MME signaling ports
iptables -A INPUT -p sctp -s 10.0.0.0/8 --dport 36412 -j ACCEPT
iptables -A INPUT -p sctp --dport 36412 -j DROP

# Monitor MME process for crashes
journalctl -u open5gs-mmed -f --since "1 hour ago"