CVE-2026-78156: Open5GS Heap-Based Buffer Overflow Vulnerability

CVE-2026-78156 Overview

CVE-2026-78156 is a heap-based buffer overflow in Open5GS 2.8.0, affecting the Home Subscriber Server (HSS) component. The flaw resides in the hss_ogs_diam_s6a_air_cb function within src/hss/hss-s6a-path.c, which handles S6a Authentication-Information-Request (AIR) Diameter messages. An attacker who can send a crafted Visited-PLMN-Id Attribute-Value Pair (AVP) triggers an out-of-bounds write on the heap. The issue is tracked under [CWE-119] and is remotely reachable over the S6a interface. Upstream maintainers merged commit a9c82ee0b590d76a581b0580cb46b598984e2392 to validate the AVP length before copying.

Critical Impact
A remote authenticated Diameter peer can send a malformed Visited-PLMN-Id AVP to corrupt heap memory in the Open5GS HSS process, risking service disruption of core 4G/5G authentication.

Affected Products

Open5GS 2.8.0
Component: HSS S6a Authentication-Information-Request Handler (src/hss/hss-s6a-path.c)
Function: hss_ogs_diam_s6a_air_cb

Discovery Timeline

2026-08-24 - CVE-2026-78156 published to NVD
2026-08-26 - Last updated in NVD database
Patch commit - a9c82ee0b590d76a581b0580cb46b598984e2392 published to the Open5GS repository

Technical Details for CVE-2026-78156

Vulnerability Analysis

Open5GS is an open source implementation of 4G Evolved Packet Core (EPC) and 5G Core Network (5GC). The HSS process handles Diameter S6a messages exchanged with the Mobility Management Entity (MME). When processing an Authentication-Information-Request, hss_ogs_diam_s6a_air_cb extracts the Visited-PLMN-Id AVP and copies its raw bytes into a fixed-size structure representing a Public Land Mobile Network identifier. The Diameter peer controls the length of that AVP directly, and the pre-patch code did not enforce the expected 3-byte PLMN identifier length before invoking memcpy. A peer supplying a longer or empty AVP causes a heap-based buffer overflow or a read of uninitialized memory, and the resulting corruption can crash the HSS or influence downstream key derivation.

Root Cause

The pre-patch implementation trusted the attacker-controlled hdr->avp_value->os.len field and only clamped the copy length with ogs_min(...) against the destination size. That guard prevents oversized writes into the local variable but still allows the raw AVP pointer, whose length is not constrained to OGS_PLMN_ID_LEN, to be forwarded into ogs_auc_kasme for KASME key derivation. The absence of an explicit length and null-pointer check on the AVP value is the direct cause classified under [CWE-119], improper restriction of operations within the bounds of a memory buffer.

Attack Vector

Exploitation requires the ability to send Diameter S6a traffic to the HSS. In production deployments this typically means a compromised or rogue MME, a misconfigured Diameter routing agent, or an operator lab environment exposing S6a to untrusted networks. The attacker crafts an AIR with a Visited-PLMN-Id AVP whose octet-string length differs from OGS_PLMN_ID_LEN (3 bytes) or whose data pointer is null, and sends it to the HSS listener.

         goto out;
     }
 
+    if (!hdr->avp_value->os.data ||
+            hdr->avp_value->os.len != OGS_PLMN_ID_LEN) {
+        ogs_error("Invalid Visited-PLMN-Id length [%d]",
+                hdr->avp_value ? (int)hdr->avp_value->os.len : -1);
+        result_code = OGS_DIAM_INVALID_AVP_VALUE;
+        error_occurred = 1;
+        goto out;
+    }
     memcpy(&visited_plmn_id, hdr->avp_value->os.data,
-            ogs_min(hdr->avp_value->os.len, sizeof(visited_plmn_id)));
+            sizeof(visited_plmn_id));
 
     /* Generate authentication vectors */
     milenage_generate(opc, auth_info.amf, auth_info.k,
         ogs_uint64_to_buffer(auth_info.sqn, OGS_SQN_LEN, sqn), auth_info.rand,
         autn, ik, ck, ak, xres, &xres_len);
-    ogs_auc_kasme(ck, ik, hdr->avp_value->os.data, sqn, ak, kasme);
+    ogs_auc_kasme(ck, ik, (uint8_t *)&visited_plmn_id, sqn, ak, kasme);

Source: Open5GS commit a9c82ee. The patch adds an explicit null and length check, replaces the clamped copy with a fixed-size memcpy, and forwards the validated local buffer to ogs_auc_kasme instead of the raw AVP pointer.

Detection Methods for CVE-2026-78156

Indicators of Compromise

HSS log entries containing Invalid Visited-PLMN-Id length after applying the patch, indicating malformed AIR traffic reaching the handler.
Unexpected HSS process restarts, segmentation faults, or crash dumps referencing hss_ogs_diam_s6a_air_cb or memcpy.
Diameter S6a AIR messages containing Visited-PLMN-Id AVPs whose length differs from 3 bytes.

Detection Strategies

Inspect S6a Diameter traffic at the Diameter Routing Agent (DRA) and drop or alert on AIR messages where Visited-PLMN-Id (AVP 1407) length is not exactly 3 octets.
Instrument the HSS host to capture core dumps and forward crash telemetry so repeated aborts on the AIR path are visible to the SOC.
Correlate HSS crash events with the sending MME identity to isolate misbehaving or unauthorized Diameter peers.

Monitoring Recommendations

Alert on abnormal rates of AIR failures or DIAMETER_INVALID_AVP_VALUE responses from the HSS.
Track HSS process uptime and restart counts as a service-health signal for the S6a control plane.
Log and review all Diameter peer origin identities permitted to reach the HSS on port 3868.

How to Mitigate CVE-2026-78156

Immediate Actions Required

Upgrade Open5GS to a build that includes commit a9c82ee0b590d76a581b0580cb46b598984e2392 or rebuild from the current main branch.
Restrict network reachability to the HSS S6a listener so only authorized MMEs and Diameter routing agents can establish connections.
Enable Diameter TLS or IPsec on the S6a interface to prevent unauthorized peers from injecting AIR traffic.

Patch Information

The fix is committed upstream as a9c82ee0b590d76a581b0580cb46b598984e2392. It validates that hdr->avp_value->os.data is non-null and that hdr->avp_value->os.len equals OGS_PLMN_ID_LEN before copying, returns OGS_DIAM_INVALID_AVP_VALUE when the check fails, and uses the validated local visited_plmn_id for KASME derivation. Operators tracking Open5GS releases should pin to a tagged version that includes this commit. See the Open5GS issue tracker entry and the VulDB record for CVE-2026-78156 for additional references.

Workarounds

Deploy a Diameter proxy or DRA rule that rejects AIR messages whose Visited-PLMN-Id AVP length is not 3 octets.
Segment the S6a network so the HSS accepts SCTP or TCP connections only from an allowlist of MME addresses.
Monitor HSS logs and automatically restart the process on crash while the patch is being rolled out to reduce service impact.

bash

# Build a patched Open5GS HSS from source
git clone https://github.com/open5gs/open5gs.git
cd open5gs
git checkout a9c82ee0b590d76a581b0580cb46b598984e2392
meson build --prefix=`pwd`/install
ninja -C build
ninja -C build install