CVE-2026-90707

High

Description

A security flaw has been discovered in Open5GS up to 2.7.x. Affected is the function amf_nnrf_try_old_amf_discovery_fallback of the file src/amf/nnrf-handler.c of the component Old AMF Discovery Fallback. The manipulation of the argument discovery_option results in use after free. The attack may be performed from remote. The patch is identified as ddd683a35f8aaac2b7b9884a24cd53bddfc65238. Applying a patch is advised to resolve this issue.

SeverityHigh

CVSS8.3

Exploit probability—

ProductOpen5gs

PublishedSep 14, 2026

First seenSep 14, 2026

Weakness typeCWE-416Use after free CWE-119Memory buffer bounds error

How to fix

Patches

Affected products

Product	Affected versions	Fixed in
open5gs open5gs	2.0, 2.1, 2.2, 2.3, 2.4, 2.5, 2.6, 2.7	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.