CVE-2026-75438

CVE-2026-75438 is a buffer overflow (CWE-120) in the ogs_sbi_time_parse() function of Open5GS v2.7.7, the open-source 4G/5G core network implementation. A remote attacker can trigger the flaw by sending malformed time-formatted input to an Open5GS network function's service-based interface (SBI), causing the parser to write past the bounds of a buffer. The impact is a crash of the affected network function, i.e. a denial of service; the CVSS vector confirms no confidentiality or integrity impact, only high availability impact, and no authentication or user interaction is required. Any operator or organization running Open5GS v2.7.7 is affected, particularly deployments where SBI-facing services are reachable by untrusted clients. Exploitation status: no public proof-of-concept is known, the flaw is not in CISA KEV, and EPSS puts 30-day exploitation probability at only about 0.5%.

What to do: Operators running Open5GS v2.7.7 should check the upstream Open5GS project (GitHub releases/security advisories) for a patched version and upgrade as soon as a fix is published, since no fixed version is named in the available data. As an interim mitigation, restrict network access to SBI-facing network functions (the HTTP/2 service interfaces) so only trusted internal components can reach them, and monitor for unexpected NF process crashes or restarts.