CVE-2026-75438 Overview
CVE-2026-75438 is a buffer overflow vulnerability in Open5GS v2.7.7, an open source implementation of 5G Core and EPC network functions. The flaw resides in the ogs_sbi_time_parse() function within the Service Based Interface (SBI) library. A remote attacker can send an overly long timestamp string to trigger a stack buffer overflow, causing the Session Management Function (SMF) to crash. Exploitation requires no authentication and no user interaction, and results in denial of service of the affected 5G core component. The weakness is classified as [CWE-120] (Buffer Copy without Checking Size of Input).
Critical Impact
A remote, unauthenticated attacker can crash the Open5GS SMF process by supplying a malformed UE location timestamp, disrupting availability of 5G core network services.
Affected Products
- Open5GS v2.7.7
- Open5GS Service Based Interface (SBI) library (lib/sbi/conv.c)
- Open5GS Session Management Function (SMF)
Discovery Timeline
- 2026-09-04 - CVE-2026-75438 published to NVD
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-75438
Vulnerability Analysis
The vulnerability exists in ogs_sbi_time_parse(), defined in lib/sbi/conv.c of the Open5GS codebase. This function parses ISO 8601-style timestamp strings received over the 5G Service Based Interface, splitting them into seconds and subsecs fixed-size buffers of length MAX_TIMESTR_LEN. The parsing loop copies characters into these buffers without validating the destination index against the buffer bounds. Supplying a timestamp longer than MAX_TIMESTR_LEN causes the index counters j and k to advance beyond the allocated space, writing attacker-controlled bytes past the end of the stack buffers. The SMF process crashes when it later dereferences corrupted stack data, terminating the 5G Session Management Function and denying service to subscribers.
Root Cause
The root cause is missing bounds checking during string parsing. ogs_sbi_time_parse() incremented the write indices for the seconds[] and subsecs[] arrays without verifying that they remained below MAX_TIMESTR_LEN - 1. Any code path that fed an untrusted, oversized timestamp into this function produced an out-of-bounds stack write.
Attack Vector
The attack vector is network based and requires no privileges. Public proof-of-concept material demonstrates crashing the SMF by delivering a crafted UE location timestamp field through 5G core signaling, reaching ogs_sbi_time_parse() during SBI message handling. See the GitHub PoC Script and the GitHub CVE-2026-75438 Resource for reproduction details.
(str[i-3] == '+' || str[i-3] == '-')) {
/* remove ':' character in timezone string range */
} else {
+ if (j >= MAX_TIMESTR_LEN - 1) {
+ ogs_error("Too long time string [%d]", (int)strlen(str));
+ return false;
+ }
seconds[j++] = str[i];
}
} else {
+ if (k >= MAX_TIMESTR_LEN - 1) {
+ ogs_error("Too long time string [%d]", (int)strlen(str));
+ return false;
+ }
subsecs[k++] = str[i];
}
Source: Open5GS commit 7227b2f5. The patch adds explicit length checks before each write and aborts parsing when the input exceeds MAX_TIMESTR_LEN - 1.
Detection Methods for CVE-2026-75438
Indicators of Compromise
- Unexpected crash or restart of the Open5GS smf process, particularly with stack corruption signatures in core dumps.
- Log entries from patched builds containing Too long time string produced by ogs_error() in ogs_sbi_time_parse().
- Inbound SBI HTTP/2 requests containing timestamp fields longer than typical ISO 8601 values (greater than roughly 32 characters).
Detection Strategies
- Inspect SBI traffic to core network functions for ueLocationTimestamp and related timestamp fields with anomalous length or non-standard formatting.
- Correlate SMF process termination events with preceding SBI requests from the same peer within a short time window.
- Monitor for repeated connection resets or 5xx errors on SBI endpoints exposed by SMF, AMF, and other Network Functions.
Monitoring Recommendations
- Enable verbose Open5GS logging and forward ogs_error entries to a centralized log platform for alerting on parser failures.
- Track process uptime and restart counts for all Open5GS Network Functions and alert on abnormal restart rates.
- Capture and retain SBI packet metadata to support post-incident reconstruction of malformed requests.
How to Mitigate CVE-2026-75438
Immediate Actions Required
- Upgrade Open5GS to a build that includes commit 7227b2f5b254160286798e058c189224360d99fc or a later release that supersedes v2.7.7.
- Restrict network reachability to SBI interfaces so only authorized 5G core peers can send requests to SMF, AMF, and related Network Functions.
- Review Open5GS logs and process supervisor history for prior crashes of the SMF that may indicate exploitation attempts.
Patch Information
The upstream fix is available in Open5GS commit 7227b2f5, which validates timestamp string length before writing into the seconds[] and subsecs[] buffers in ogs_sbi_time_parse(). Additional context is tracked in Open5GS Issue #4612. Rebuild and redeploy affected Network Functions after applying the patch.
Workarounds
- Place a reverse proxy or API gateway in front of SBI endpoints that rejects HTTP requests containing timestamp fields exceeding a strict maximum length.
- Enforce network segmentation and mutual TLS between 5G Network Functions so untrusted hosts cannot reach the vulnerable SBI parser.
- Configure a process supervisor (for example, systemd with automatic restart) to reduce downtime while patching, understanding this does not prevent exploitation.
# Build and deploy the patched Open5GS version
git clone https://github.com/open5gs/open5gs.git
cd open5gs
git checkout 7227b2f5b254160286798e058c189224360d99fc
meson build --prefix=`pwd`/install
ninja -C build
ninja -C build install
# Restart affected Network Functions
systemctl restart open5gs-smfd
systemctl restart open5gs-amfd
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
