CVE-2026-82587 Overview
CVE-2026-82587 is a memory corruption vulnerability in Open5GS versions up to 2.7.7. The flaw resides in the amf_namf_comm_decode_ue_mm_context_list function within src/amf/namf-handler.c, part of the Access and Mobility Management Function (AMF) component. Attackers can trigger the issue by manipulating the ueContext.mmContextList[*].allowedNssai argument over the network. The vendor addressed the issue in Open5GS 2.8.0 via commit abf8a836564b966b5141110fc25ed413c4f17522. The exploit has been publicly disclosed, though impact is limited to availability with low authenticated privileges required.
Critical Impact
Remote authenticated attackers can trigger memory corruption in the Open5GS AMF, potentially disrupting 5G core network mobility management services.
Affected Products
- Open5GS versions up to and including 2.7.7
- Open5GS AMF component (src/amf/namf-handler.c)
- 5G core network deployments using vulnerable Open5GS builds
Discovery Timeline
- 2026-08-30 - CVE-2026-82587 published to the National Vulnerability Database
- 2026-08-31 - Last updated in NVD database
- Patch commit - abf8a836564b966b5141110fc25ed413c4f17522 merged in Open5GS release 2.8.0
Technical Details for CVE-2026-82587
Vulnerability Analysis
The vulnerability is classified under CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer. It affects the decoding path for UE (User Equipment) Mobility Management context lists exchanged between 5G core network functions over the Namf service-based interface.
When the AMF processes a ueContext structure, the amf_namf_comm_decode_ue_mm_context_list function parses the nested mmContextList[*].allowedNssai field. Insufficient bounds checking during this deserialization allows crafted values to corrupt adjacent memory. The corruption can crash the AMF daemon and disrupt registration, handover, and session management for subscribers attached to the affected network.
Exploitation requires network reachability to the AMF service-based interface and low-privilege authentication, consistent with a peer network function abusing legitimate NF-to-NF signaling. The public disclosure of the issue increases the likelihood of opportunistic use against exposed lab and operator deployments.
Root Cause
The root cause is improper validation of length and structural constraints when decoding attacker-influenced allowedNssai entries inside the UE MM context list. Without strict checks, the decoder writes or reads outside the intended buffer, producing memory corruption in the AMF process address space.
Attack Vector
The attack vector is network-based against the Namf communication interface exposed by the AMF. An attacker with the ability to send Namf messages, such as a compromised or rogue network function within the 5G service-based architecture, submits a malformed ueContext.mmContextList[*].allowedNssai payload to the vulnerable decoder. Technical details are available in the Open5GS issue tracker and VulDB entry for CVE-2026-82587.
No verified exploit code is reproduced here. Refer to the upstream patch commit for the exact code path and fix.
Detection Methods for CVE-2026-82587
Indicators of Compromise
- Unexpected AMF process crashes, restarts, or core dumps on Open5GS nodes running versions at or below 2.7.7.
- Malformed or oversized allowedNssai fields in Namf ue-contexts messages captured on the service-based interface.
- Bursts of failed UE registration or handover events correlated with AMF service interruptions.
Detection Strategies
- Inspect Namf HTTP/2 traffic for ueContext.mmContextList structures with abnormally large or malformed allowedNssai arrays.
- Monitor Open5GS AMF logs for decode errors originating from amf_namf_comm_decode_ue_mm_context_list in src/amf/namf-handler.c.
- Alert on repeated AMF restarts, systemd service failures, or generation of core files on 5G core hosts.
Monitoring Recommendations
- Forward AMF logs and process crash telemetry to a centralized SIEM for correlation with signaling anomalies.
- Baseline normal peer network function behavior on the Namf interface and alert on deviations in message size and structure.
- Track deployed Open5GS versions across the fleet and flag any node still running 2.7.7 or earlier.
How to Mitigate CVE-2026-82587
Immediate Actions Required
- Upgrade Open5GS to version 2.8.0 or later, which includes patch commit abf8a836564b966b5141110fc25ed413c4f17522.
- Restrict Namf service-based interface access to authenticated, authorized network functions only.
- Audit all 5G core nodes to confirm no test or lab AMF instances are exposed to untrusted networks.
Patch Information
The vendor fixed the vulnerability in Open5GS release v2.8.0. The corrective change is available in the upstream commit abf8a836564b966b5141110fc25ed413c4f17522, which hardens decoding of the ueContext.mmContextList[*].allowedNssai field in src/amf/namf-handler.c.
Workarounds
- Segment the 5G service-based architecture so only trusted network functions can reach the AMF Namf endpoint.
- Enforce mutual TLS and OAuth 2.0 token validation between network functions to reduce the attacker population.
- Apply network-level rate limiting and message-size caps on Namf communications to constrain malformed payload delivery.
# Upgrade Open5GS to the fixed release
git clone https://github.com/open5gs/open5gs.git
cd open5gs
git checkout v2.8.0
meson build --prefix=`pwd`/install
ninja -C build
ninja -C build install
# Verify the deployed version no longer matches the vulnerable range (<= 2.7.7)
open5gs-amfd -v
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
