PatchSiren cyber security CVE debrief
CVE-2026-8782 omec-project CVE debrief
A null pointer dereference vulnerability exists in the OMEC Project AMF (Access and Mobility Management Function) NGAP message handler, affecting versions up to 2.1.3-dev. The flaw resides in ngap/handler.go and can be triggered remotely by an authenticated attacker with low privileges. Successful exploitation causes availability impact through service disruption. The vulnerability has been publicly disclosed with exploit availability, though CVSS 4.0 scoring indicates limited severity (2.1 LOW) due to authentication requirements and localized impact scope. A fix is available in version 2.2.0 via pull request 666, which addresses multiple security issues.
- Vendor
- omec-project
- Product
- amf
- CVSS
- LOW 2.1
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-18
- Original CVE updated
- 2026-05-18
- Advisory published
- 2026-05-18
- Advisory updated
- 2026-05-18
Who should care
Telecommunications operators deploying OMEC Project AMF in 5G core networks; security teams managing mobile core infrastructure; network engineers responsible for AMF NGAP interface security; organizations using open source 5G core implementations
Technical summary
The vulnerability exists in the NGAP (Next Generation Application Protocol) message handler component of the OMEC Project AMF, specifically within ngap/handler.go. A null pointer dereference can be triggered when processing malformed or unexpected NGAP messages, leading to service disruption. The attack vector is network-based with low attack complexity, but requires low-privileged authentication. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L) reflects network accessibility with availability impact as the primary concern. The fix in version 2.2.0 addresses this and additional security issues through comprehensive input validation and null pointer checks in the NGAP handler implementation.
Defensive priority
medium
Recommended defensive actions
- Upgrade OMEC Project AMF to version 2.2.0 or later to remediate this vulnerability
- Review network segmentation for AMF NGAP interfaces to limit attack exposure
- Monitor for anomalous NGAP message patterns that may indicate exploitation attempts
- Validate that AMF deployments are not exposed to untrusted networks without authentication controls
- Review pull request 666 changelog for additional security fixes included in the 2.2.0 release
Evidence notes
Vulnerability disclosed via VulDB and NVD on 2026-05-18. Exploit availability confirmed in source metadata. Fix confirmed through official GitHub release tagging and pull request merge.
Official resources
public