Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-8186— Open5GS NF client.c ogs_sbi_client_send_via_scp_or_sepp out-of-bounds

Quick assessment

Affected

n/a Open5GS

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Open5GS是Open5GS开源的一个 5G Core 和 Epc 的 C 语言开源实现，即 Lte/Nr 网络的核心网络。 Open5GS 2.7.7及之前版本存在缓冲区错误漏洞，该漏洞源于NF组件中库lib/sbi/client.c的ogs_sbi_client_send_via_scp_or_sepp函数执行操作导致越界读取，攻击者可远程利用。

CVSS 5.3 · Medium EPSS 0.52% · P45 Updated May 15, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 8

Vendor	Product	Version Range	Status
n/a	Open5GS	`2.7.0`	affected
		`2.7.1`	affected
		`2.7.2`	affected
		`2.7.3`	affected
		`2.7.4`	affected
		`2.7.5`	affected
		`2.7.6`	affected
		`2.7.7`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-8186

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Open5GS NF client.c ogs_sbi_client_send_via_scp_or_sepp out-of-bounds

Source: CVE Program / CVE List V5

Vulnerability Description

A vulnerability was detected in Open5GS up to 2.7.7. This affects the function ogs_sbi_client_send_via_scp_or_sepp in the library lib/sbi/client.c of the component NF. Performing a manipulation results in out-of-bounds read. The attack is possible to be carried out remotely. The patch is named d5bc487fcf9ea87d2b03f2ef95123af344773bfb. It is suggested to install a patch to address this issue.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Source: CVE Program / CVE List V5

Vulnerability Type

跨界内存读

Source: CVE Program / CVE List V5

Vulnerability Title

Open5GS 缓冲区错误漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
-	Open5GS	2.7.0	`cpe:2.3:a:open5gs:open5gs::::::::`

II. Public POCs for CVE-2026-8186

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-8186

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-8186 (2)

News Coverage for CVE-2026-8186 (1)

🔗 [Bug]: UPF (open5gs-upfd) SIGSEGV (exit 139) under crafted GTP-U traffic on UDP/2152 · Issue #4491 · open5gs/open5gs Read full article issue-tracking

https://www.cve.org/CVERecord?id=CVE-2026-8186

Same Patch Batch · n/a · 2026-05-09 · 10 CVEs total

CVE-2026-6665	8.1 HIGH	PgBouncer buffer overflow in SCRAM
CVE-2026-6664	7.5 HIGH	PgBouncer integer overflow in PgBouncer network packet parsing
CVE-2026-8193	6.3 MEDIUM	Akaunting Invoice PDF Rendering dompdf.php server-side request forgery
CVE-2026-6666	5.9 MEDIUM	PgBouncer crash in kill_pool_logins_server_error
CVE-2026-8187	5.3 MEDIUM	Open5GS UPF gtp-path.c _gtpv1_u_recv_cb resource consumption
CVE-2026-8195	4.3 MEDIUM	JeecgBoot SVG File CommonController.java cross site scripting
CVE-2026-8194	4.3 MEDIUM	osTicket Dispatcher class.dispatcher.php cross-site request forgery
CVE-2026-6667	4.3 MEDIUM	PgBouncer missing authorization check in KILL_CLIENT admin command
CVE-2026-8196	3.7 LOW	JeecgBoot mLogin Endpoint LoginController.java authorization

IV. Related Vulnerabilities

Same product: Open5GS

Same vendor: n/a

Same weakness: CWE-125