CVE-2026-82587
Description
A vulnerability was determined in Open5GS up to 2.7.7. This vulnerability affects the function amf_namf_comm_decode_ue_mm_context_list of the file src/amf/namf-handler.c of the component AMF. This manipulation of the argument ueContext.mmContextList[*].allowedNssai causes memory corruption. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2.8.0 is able to resolve this issue. Patch name: abf8a836564b966b5141110fc25ed413c4f17522. It is recommended to upgrade the affected component.
Predictions
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
No mitigations published for this CVE yet.
The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.
Propose a mitigation on Community Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here withsource_tier=community-verified.
References
- https://github.com/open5gs/open5gs/
- https://github.com/open5gs/open5gs/commit/abf8a836564b966b5141110fc25ed413c4f17522
- https://github.com/open5gs/open5gs/issues/4398
- https://github.com/open5gs/open5gs/releases/tag/v2.8.0
- https://vuldb.com/cve/CVE-2026-82587
- https://vuldb.com/submit/891890
- https://vuldb.com/vuln/397082
- https://vuldb.com/vuln/397082/cti
CWEs
CWE-119
Community-verified mitigations for this CVE will appear above when contributors publish them.
Verify integrity in audit chain (admin only). AS-IS.