Open5GS version 2.8.0 contains a high-severity memory corruption vulnerability that could be leveraged by an authenticated user to cause service disruption.

This vulnerability involves an out-of-bounds read and general memory corruption within the Open5GS software. It requires the attacker to have low-level privileges (authenticated) to trigger the flawed function, which may result in an application crash or potentially more severe memory exploitation.

The vulnerability carries a CVSS score of 7.4, indicating a high risk to availability and system integrity. In a telecommunications or core network environment, an application crash could lead to a denial of service for connected users, impacting critical communication infrastructure and causing significant operational downtime.

Immediate Action: Update Open5GS to the latest stable version where the fix has been implemented, as referenced in the upstream commit.

Proactive Monitoring: Review system logs for signs of segmentation faults, unexpected application restarts, or abnormal memory usage patterns in the Open5GS processes.

Compensating Controls: Employ memory protection mechanisms, such as Address Space Layout Randomization (ASLR) or Data Execution Prevention (DEP), to reduce the likelihood of successful memory corruption exploitation.

Public Exploit Available: Unknown.

Given the critical role of Open5GS in network infrastructure, administrators should prioritize applying the vendor-supplied security updates. The existence of a proof-of-concept increases the urgency of patching to prevent potential exploitation of this memory corruption flaw.