CVE-2026-33282CWE-476

Ella Core panics on malformed NGAP Location Report

High · published March 23, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
46.1
In the wild
Unconfirmed
What it is

Ella Core is a 5G core designed for private networks. Versions prior to 1.6.0 panic when processing a malformed NGAP LocationReport message with `ue-presence-in-area-of-interest` event type and omitting the optional `UEPresenceInAreaOfInterestList` IE. An attacker able to send crafted NGAP messages to Ella Core can crash the process, causing service disruption for all connected subscribers. No authentication is required. Version 1.6.0 added IE presence verification to NGAP message handling.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00563 · 46.1th percentile
Weakness
CWE-476 · NULL Pointer Dereference
Published
2026-03-23T23:47Z
EPSS history
Timeline
  • 23 MAR 23:47Z
    Ella Core panics on malformed NGAP Location Report
    cvelistv5