CVE-2026-82587 Open5GS CVE debrief

Who should care

Users and administrators of Open5GS versions up to 2.7.7 should be aware of this vulnerability and take necessary actions to upgrade or patch their systems. Operators, platform administrators, and security teams need to assess potential impact and implement compensating controls if immediate remediation is not feasible. Monitoring and detection capabilities should be reviewed to identify potential exploitation attempts. Asset inventory and change management processes should also be evaluated to ensure timely detection and remediation of exposed systems. Security teams should track exceptions and retest remediated assets to confirm effectiveness of implemented controls. Vulnerability management processes should be updated to include this CVE and associated risk mitigation strategies. Source tracking and incident response plans should be reviewed to ensure readiness in case of exploitation. Compensating controls such as network segmentation, access controls, and enhanced monitoring should be considered for exposed systems while remediation is scheduled and verified. Rollback and change window management processes should be evaluated to minimize potential downtime and operational impact during remediation. These actions will help minimize potential operational impact and ensure effective vulnerability management. Review of CVE Program and NVD records is recommended for additional details and updates on this vulnerability. Additional defensive review is recommended due to limited CVSS score of 2.1 and lack of detailed vulnerability information, but priority should be based on actual operational risk and potential impact on managed environments. Limited evidence suggests remote exploitation is possible, but detailed exploit information is not publicly available. Defensive measures should focus on detection, patching, and compensating controls. Asset owners should confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. Compensating controls for exposed systems should be reviewed while remediation is scheduled and verified. Monitoring, detection, and logs for exposed assets should be checked for extra review. Source

Technical summary

The Open5GS vulnerability CVE-2026-82587 allows for memory corruption through manipulation of the amf_namf_comm_decode_ue_mm_context_list function in src/amf/namf-handler.c. The attack can be initiated remotely and has been publicly disclosed. Upgrading to version 2.8.0 or applying the specified patch mitigates the issue. Affected deployments should prioritize verification of their environments and plan for vendor-supported updates or mitigations.

Defensive priority

Low-priority defensive review recommended due to limited CVSS score of 2.1 and lack of detailed vulnerability information.

Recommended defensive actions

• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Inventory and verify Open5GS version; upgrade to 2.8.0 if vulnerable

Evidence notes

Evidence is limited; primary official records indicate a vulnerability in Open5GS up to 2.7.7, affecting the AMF component. Memory corruption possible via manipulation of ueContext.mmContextList[*].allowedNssai. Upgrade to version 2.8.0 or apply patch abf8a836564b966b5141110fc25ed413c4f17522. Further verification is recommended to confirm affected scope and assess potential operational impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.