CVE-2026-82588CWE-404CWE-476

CVE-2026-82588

Medium · published August 31, 2026

CVSS v3.1
4.3
EPSS
1%
Percentile
44.9
In the wild
Unconfirmed
What it is

A vulnerability was identified in Open5GS up to 2.7.7. This issue affects some unknown processing of the file src/amf/namf-handler.c of the component Transfer Endpoint. Such manipulation leads to null pointer dereference. The attack can be launched remotely. Upgrading to version 2.8.0 is capable of addressing this issue. The name of the patch is abf8a836564b966b5141110fc25ed413c4f17522. Upgrading the affected component is advised.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X
EPSS
0.00545 · 44.9th percentile
Weaknesses
CWE-404 · Improper Resource Shutdown or Release; CWE-476 · NULL Pointer Dereference
Published
2026-08-31T02:17Z
References (9)
https://vuldb.com/vuln/397083/cti · [email protected]https://github.com/open5gs/open5gs/ · [email protected]https://github.com/open5gs/open5gs/commit/abf8a836564b966b5141110fc25ed413c4f17522 · [email protected]https://github.com/open5gs/open5gs/issues/4397 · [email protected]https://github.com/open5gs/open5gs/releases/tag/v2.8.0 · [email protected]https://vuldb.com/cve/CVE-2026-82588 · [email protected]https://vuldb.com/submit/891891 · [email protected]https://vuldb.com/vuln/397083 · [email protected]https://github.com/open5gs/open5gs/issues/4397 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 01 SEP 03:32Z
    EPSS moved — → 0%
    epss
  • 30 AUG 22:00Z
    Open5GS Transfer Endpoint namf-handler.c null pointer dereference
    cvelistv5