What’s Vulnerable › Vulnerabilities

CVE-2026-15720: Pre-auth heap out-of-bounds read in the AMF NAS 5GS mobile-identity handler

• Severity: high (CVSS 8.6 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-14 · updated 2026-07-15
• Weakness: CWE-125

Description

In Open5GS through version 2.7.7 a pre-authentication heap out-of-bounds read in the AMF NAS 5GS mobile-identity handler may result in subscriber-wide denial of service.

Affected products

• Open5GS: through 2.7.7

References

• https://github.com/open5gs/open5gs/security/advisories/GHSA-f4mx-3x6p-cfwp
• https://github.com/open5gs/open5gs/security/advisories/GHSA-f4mx-3x6p-cfwp

Get alerted when CVE-2026-15720 or the next vulnerability affects your stack