Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-116543— Open5GS 1.3.0 through 2.8.0 Heap Out-of-Bounds Write via SBI Multipart Parser

Quick assessment

Affected

open5gs open5gs

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Open5GS 1.3.0 至 2.8.0 版本在函数中存在堆越界写入漏洞。未认证的攻击者可通过提供空的 multipart 边界来利用该漏洞，从而破坏内存。攻击者可以向任何网络功能的 SBI 接口发送一个精心构造的请求，导致回溯缓冲区溢出并引发服务崩溃。

CVSS 7.5 · High Updated Oct 26, 2026

Possible ATT&CK Techniques 2 AI

T1499.001 · OS Exhaustion Flood T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Open5GS 1.3.0 through 2.8.0 Heap Out-of-Bounds Write via SBI Multipart Parser

Source: CVE Program / CVE List V5

Vulnerability Description

Open5GS 1.3.0 through 2.8.0 contains a heap out-of-bounds write vulnerability in parse_multipart() that allows unauthenticated attackers to corrupt memory by supplying an empty multipart boundary. Attackers can send a single crafted multipart/related request to the SBI interface of any network function, overflowing the lookbehind buffer and crashing it.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

跨界内存写

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
open5gs	open5gs	1.3.0 ~ 2.8.0	-

II. Public POCs for CVE-2026-116543

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-116543

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-116543 (1)

🔗 [SBI] Reject empty multipart boundaries · open5gs/open5gs@6820c27 · GitHub patch

Vendor Advisories for CVE-2026-116543 (2)

Vendor Pages for CVE-2026-116543 (1)

🔗 open5gs/lib/sbi/contrib/multipart_parser.c at v2.8.0 · open5gs/open5gs · GitHub Read full article technical-description

Other References for CVE-2026-116543 (1)

🔗 GitHub - open5gs/open5gs: Open5GS is a C-language Open Source implementation for 5G Core and EPC, i.e. the core network of LTE/NR network (Release-19) · GitHub Read full article product

https://www.cve.org/CVERecord?id=CVE-2026-116543

IV. Related Vulnerabilities

Same product: open5gs

Same vendor: open5gs

Same weakness: CWE-787