CVE-2026-92417 Overview
CVE-2026-92417 is a null pointer dereference vulnerability [CWE-404] in Open5GS versions up to 2.8.0. The flaw resides in the ogs_pfcp_parse_volume_measurement function within the lib/pfcp/types.c source file of the Packet Forwarding Control Protocol (PFCP) Handler component. An attacker with low privileges can trigger the dereference remotely over the network. Successful exploitation causes the affected Open5GS process to crash, disrupting mobile core network services that rely on PFCP session management. The maintainers have published a fix in commit 8f07b507b78ff94776f2cd49276eb116ed93d7f2.
Critical Impact
Remote attackers can crash Open5GS PFCP-handling components, disrupting 4G/5G control-plane processing and causing denial of service across dependent subscriber sessions.
Affected Products
- Open5GS versions up to and including 2.8.0
- The lib/pfcp/types.c PFCP Handler library component
- Deployments exposing the ogs_pfcp_parse_volume_measurement code path (SMF, UPF, and related PFCP peers)
Discovery Timeline
- 2026-09-16 - CVE-2026-92417 published to the National Vulnerability Database
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-92417
Vulnerability Analysis
Open5GS is an open-source implementation of 4G LTE and 5G core network functions. PFCP is the protocol used between the control-plane function (SMF) and the user-plane function (UPF) to manage subscriber sessions and usage reporting. The vulnerable routine, ogs_pfcp_parse_volume_measurement, parses volume measurement information elements delivered inside PFCP messages such as usage reports. The function fails to validate a pointer before dereferencing it, allowing malformed or unexpected input to trigger a null pointer dereference and terminate the process. Because PFCP is central to session establishment and reporting, a crash removes the affected node from service and interrupts bearer management for connected subscribers.
Root Cause
The defect is a missing input validation and pointer check before accessing structure members inside ogs_pfcp_parse_volume_measurement in lib/pfcp/types.c. When the parser encounters a crafted PFCP information element lacking expected fields, it operates on a null pointer instead of returning an error, producing a segmentation fault classified under CWE-404 (Improper Resource Shutdown or Release).
Attack Vector
An authenticated PFCP peer, or an attacker able to reach the PFCP interface between SMF and UPF, sends a crafted PFCP message containing a malformed volume measurement information element. The Open5GS process invokes ogs_pfcp_parse_volume_measurement, dereferences the null pointer, and crashes. The attack requires network reachability to the PFCP endpoint and low privileges, and it does not require user interaction.
No public exploit or proof-of-concept code is available. The vulnerability mechanism is documented in GitHub Issue #4745 and the corresponding patch commit.
Detection Methods for CVE-2026-92417
Indicators of Compromise
- Unexpected termination or restart of Open5GS SMF, UPF, or other PFCP-handling processes
- Segmentation fault entries in system logs referencing ogs_pfcp_parse_volume_measurement or lib/pfcp/types.c
- Sudden loss of PFCP association between SMF and UPF nodes
- Subscriber session drops or bearer setup failures correlated with malformed PFCP traffic
Detection Strategies
- Inspect PFCP traffic for malformed volume measurement information elements using protocol-aware network sensors
- Alert on repeated process crashes of Open5GS core components in orchestration or systemd logs
- Correlate PFCP session teardowns with anomalous inbound messages from unexpected source addresses
Monitoring Recommendations
- Monitor the health and uptime of SMF and UPF processes with liveness probes
- Capture and retain PFCP packet traces on control-plane interfaces for post-incident analysis
- Track authentication and source addresses of PFCP peers to identify unauthorized senders
How to Mitigate CVE-2026-92417
Immediate Actions Required
- Upgrade Open5GS to a build that includes commit 8f07b507b78ff94776f2cd49276eb116ed93d7f2
- Restrict PFCP interface exposure to trusted control-plane and user-plane nodes only
- Enforce network segmentation so PFCP endpoints are unreachable from subscriber and external networks
Patch Information
The Open5GS maintainers addressed the null pointer dereference in commit 8f07b507b78ff94776f2cd49276eb116ed93d7f2. Operators running Open5GS 2.8.0 or earlier should rebuild from the patched source or upgrade to a subsequent release containing the fix. Patch details are available at the Open5GS repository and the VulDB entry.
Workarounds
- Apply strict firewall rules limiting PFCP (UDP/8805) access to authorized SMF and UPF nodes
- Deploy Open5GS behind IPsec or private overlay networks to prevent untrusted peers from reaching the parser
- Enable automatic process supervision to restart crashed components while patching is scheduled
# Example iptables rule limiting PFCP access to a trusted SMF peer
iptables -A INPUT -p udp --dport 8805 -s 10.0.0.10 -j ACCEPT
iptables -A INPUT -p udp --dport 8805 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
