CVE-2026-15720 Pre-auth heap out-of-bounds read in the AMF NAS 5GS mobile-identity handler
A pre-authentication heap out-of-bounds read in Open5GS allows attackers to cause subscriber-wide denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-15720?
CVE-2026-15720 is a high-severity memory corruption vulnerability in open5gs, published on 14 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Open5GS through version 2.7.7 a pre-authentication heap out-of-bounds read in the AMF NAS 5GS mobile-identity handler may result in subscriber-wide denial of service.
Weakness: CWE-125
Which versions are affected by CVE-2026-15720?
How do I fix CVE-2026-15720?
No fix has been published for CVE-2026-15720 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-15720 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-15720 exists.
Sources
Also known as GHSA-2vfm-v289-h559, GHSA-f4mx-3x6p-cfwp.