CVE-2026-90707: Open5GS Use After Free Vulnerability

CVE-2026-90707 Overview

CVE-2026-90707 is a use-after-free vulnerability in Open5GS versions up to 2.7.x. The flaw resides in the amf_nnrf_try_old_amf_discovery_fallback function within src/amf/nnrf-handler.c, part of the Old AMF Discovery Fallback component. Manipulation of the discovery_option argument triggers use-after-free conditions in the Access and Mobility Management Function (AMF). The vulnerability is remotely exploitable without authentication or user interaction. Open5GS is an open-source 5G Core and EPC implementation deployed in mobile network research and production environments. A patch identified as commit ddd683a35f8aaac2b7b9884a24cd53bddfc65238 resolves the issue.

Critical Impact
Remote attackers can trigger memory corruption in the AMF component, potentially leading to service disruption or memory-related exploitation of a critical 5G core network function.

Affected Products

Open5GS versions up to and including 2.7.x
Open5GS AMF (Access and Mobility Management Function) component
Deployments using the Old AMF Discovery Fallback code path in nnrf-handler.c

Discovery Timeline

2026-09-14 - CVE-2026-90707 published to NVD
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-90707

Vulnerability Analysis

The vulnerability is a use-after-free condition [CWE-119] in the AMF's NRF (Network Repository Function) handler. The amf_nnrf_try_old_amf_discovery_fallback function accepted a pointer to an ogs_sbi_discovery_option_t structure that could be freed or become invalid while still referenced later in the fallback logic. When the function subsequently dereferences the stale pointer, memory corruption occurs within the running AMF process.

Because the AMF handles 5G UE registration and mobility signaling, faults in this path affect availability of subscriber attach and handover procedures. The attack vector is network-based and requires no authentication, aligning with the Service Based Interface (SBI) exposure of the AMF.

Root Cause

The root cause is improper lifetime management of the discovery_option argument passed to amf_nnrf_try_old_amf_discovery_fallback. The upstream fix in commit ddd683a35f8aaac2b7b9884a24cd53bddfc65238 removes the freed pointer from the function signature entirely and replaces it with a bool guami_presence flag, eliminating the dangling reference.

Attack Vector

Exploitation requires network reachability to the AMF's SBI endpoints. An attacker able to send crafted NRF discovery-related signaling that drives the AMF into the Old AMF Discovery Fallback path can trigger the use-after-free without credentials or user interaction.

 static bool amf_nnrf_try_old_amf_discovery_fallback(
         amf_ue_t *amf_ue, OpenAPI_nf_type_e requester_nf_type,
-        ogs_sbi_discovery_option_t *discovery_option)
+        bool guami_presence)
 {
     int r;

Source: Open5GS Commit ddd683a — the patch removes the freed discovery_option pointer parameter and replaces it with a boolean flag, eliminating the stale reference.

Detection Methods for CVE-2026-90707

Indicators of Compromise

Unexpected AMF process crashes, segmentation faults, or restarts logged by the Open5GS service manager.
Anomalous NRF discovery signaling patterns directed at AMF SBI endpoints from untrusted sources.
Correlated UE registration or handover failures coinciding with AMF instability.

Detection Strategies

Monitor AMF logs for abnormal termination in code paths referencing amf_nnrf_try_old_amf_discovery_fallback or nnrf-handler.c.
Inspect SBI traffic for malformed or unexpected discovery option payloads originating outside the trusted 5G core network.
Track version inventory to identify Open5GS deployments still running 2.7.x or earlier.

Monitoring Recommendations

Enable core dump collection on AMF hosts to capture evidence of memory corruption for forensic analysis.
Forward AMF, NRF, and SBI proxy logs to a centralized analytics platform for correlation.
Alert on repeated AMF restarts within short time windows as a proxy signal for exploitation attempts.

How to Mitigate CVE-2026-90707

Immediate Actions Required

Apply upstream patch commit ddd683a35f8aaac2b7b9884a24cd53bddfc65238 and rebuild Open5GS from source.
Restrict network access to AMF SBI interfaces so only trusted 5G core Network Functions can reach them.
Inventory all Open5GS instances and prioritize patching of internet-exposed or lab-shared deployments.

Patch Information

The fix is available in the Open5GS project via Pull Request #4698 and merged as commit ddd683a. Operators should upgrade to a build that includes this commit. Additional context is available at the Open5GS repository and the VulDB entry for CVE-2026-90707.

Workarounds

Place AMF SBI endpoints behind a Service Communication Proxy (SCP) or firewall enforcing strict allowlists.
Segment the 5G core control plane onto isolated management networks unreachable from user or external networks.
Disable or avoid deployment topologies that exercise the Old AMF Discovery Fallback path when feasible until patching is complete.

bash

# Example: restrict AMF SBI TCP port to trusted core NF subnet only
iptables -A INPUT -p tcp --dport 7777 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7777 -j DROP