CVE-2026-78157: Open5GS Rx Handler RCE Vulnerability

CVE-2026-78157 Overview

CVE-2026-78157 is an out-of-bounds read vulnerability in Open5GS 2.8.0, an open-source implementation of 5G Core and EPC. The flaw resides in the pcrf_rx_aar_cb function within src/pcrf/pcrf-rx-path.c, which handles Rx AA-Request messages in the Policy and Charging Rules Function (PCRF) component. An attacker can trigger the condition remotely by sending a crafted Diameter AA-Request with a malformed Framed-IP-Address Attribute-Value Pair (AVP). The vulnerability is classified under [CWE-119] (Improper Restriction of Operations within the Bounds of a Memory Buffer).

Critical Impact
Remote attackers with low privileges on the Diameter Rx interface can cause the PCRF process to read memory outside allocated bounds, potentially leading to information disclosure or process instability affecting 5G/LTE policy control.

Affected Products

Open5GS 2.8.0
Open5GS PCRF component (Diameter Rx AA-Request Handler)
Deployments exposing the Rx interface to untrusted networks

Discovery Timeline

2026-08-24 - CVE-2026-78157 published to NVD
2026-08-24 - Patch commit c18dc6938bf63cc7374315d3dca303d92066e746 referenced in advisory
2026-08-24 - Last updated in NVD database

Technical Details for CVE-2026-78157

Vulnerability Analysis

The vulnerability affects the Diameter Rx interface handler in Open5GS PCRF. When processing an AA-Request (AAR) message, pcrf_rx_aar_cb searches for the Framed-IP-Address AVP and passes its data buffer directly to pcrf_sess_find_by_ipv4. The handler does not validate the AVP payload length before dereferencing the underlying buffer. An attacker who can reach the Rx interface as an authenticated Diameter peer can send an AAR containing a Framed-IP-Address AVP with a length shorter than the expected 4-byte IPv4 address. The PCRF then reads adjacent heap memory, resulting in an out-of-bounds read.

Root Cause

The root cause is missing length validation on the Framed-IP-Address AVP. The code assumed the AVP payload always matched OGS_IPV4_LEN (4 bytes) and did not verify hdr->avp_value->os.len or check that hdr->avp_value->os.data was non-null. Malformed AVPs with mismatched length fields therefore reached downstream lookup logic that indexes the buffer as a 4-byte IPv4 address.

Attack Vector

Exploitation requires network reachability to the PCRF Rx interface and a valid Diameter peer relationship (the CVSS vector indicates low privileges are required). An attacker crafts a Diameter AAR command with a truncated or zero-length Framed-IP-Address AVP and sends it to the PCRF. The PCRF processes the AVP and reads memory outside the intended buffer bounds, which may leak adjacent memory contents into subsequent processing paths or destabilize the daemon.

     ret = fd_msg_search_avp(qry, ogs_diam_rx_framed_ip_address, &avp);
     if (ret == 0 && avp) {
         ret = fd_msg_avp_hdr(avp, &hdr);
-        if (ret == 0 && hdr) {
+        if (ret == 0 && hdr && hdr->avp_value) {
+            if (!hdr->avp_value->os.data ||
+                hdr->avp_value->os.len != OGS_IPV4_LEN) {
+                ogs_error("Invalid Framed-IP-Address length [%zu]",
+                hdr->avp_value->os.len);
+
+                result_code = ER_DIAMETER_INVALID_AVP_VALUE;
+                error_occurred = 1;
+                goto out;
+            }
+
             gx_sid = (os0_t)pcrf_sess_find_by_ipv4(hdr->avp_value->os.data);
             if (!gx_sid) {
                 ogs_warn("Cannot find Gx Session for IPv4:%s",

Source: GitHub Commit c18dc69 — the patch adds explicit checks for avp_value, os.data, and os.len == OGS_IPV4_LEN, returning ER_DIAMETER_INVALID_AVP_VALUE when validation fails.

Detection Methods for CVE-2026-78157

Indicators of Compromise

Open5GS PCRF error logs containing Invalid Framed-IP-Address length entries after the patch is applied
PCRF process crashes, segmentation faults, or abnormal restarts correlated with inbound Rx traffic
Diameter AAR messages containing Framed-IP-Address AVPs where the payload length is not 4 bytes

Detection Strategies

Inspect Diameter traffic on the Rx interface for AAR commands with malformed Framed-IP-Address AVP lengths using packet capture tools such as Wireshark with the Diameter dissector
Deploy runtime memory safety tooling (AddressSanitizer, Valgrind) on non-production PCRF builds to surface out-of-bounds reads during fuzzing
Correlate PCRF ogs_error and ogs_warn log entries with source IPs of Diameter peers to identify anomalous senders

Monitoring Recommendations

Enable verbose logging on pcrf-rx-path.c handlers and forward logs to a centralized SIEM for pattern analysis
Track PCRF process resident memory and crash counts as service health indicators
Alert on unexpected Diameter peers or unusual AAR volumes reaching the Rx interface

How to Mitigate CVE-2026-78157

Immediate Actions Required

Apply the upstream patch commit c18dc6938bf63cc7374315d3dca303d92066e746 from the Open5GS repository and rebuild PCRF binaries
Restrict Rx interface exposure to trusted Diameter peers only (P-CSCF nodes) via network segmentation and firewall rules
Validate Diameter peer identities using IPsec or TLS where supported

Patch Information

The fix is available in Open5GS via commit c18dc6938bf63cc7374315d3dca303d92066e746, which validates Framed-IP-Address AVP length against OGS_IPV4_LEN and rejects malformed AVPs with ER_DIAMETER_INVALID_AVP_VALUE. Track resolution status in GitHub Issue #4663 and consult the VulDB entry for CVE-2026-78157 for additional metadata.

Workarounds

Place PCRF nodes behind a Diameter Routing Agent (DRA) that performs strict AVP length validation before forwarding messages
Apply access control lists restricting SCTP/TCP port 3868 to known P-CSCF source addresses
Where patching is not immediately feasible, monitor PCRF logs and process health closely and rebuild from source with the referenced patch applied

bash

# Rebuild Open5GS PCRF with the security patch applied
git clone https://github.com/open5gs/open5gs.git
cd open5gs
git checkout c18dc6938bf63cc7374315d3dca303d92066e746
meson build --prefix=`pwd`/install
ninja -C build
ninja -C build install

# Restart the PCRF service after installation
systemctl restart open5gs-pcrfd