CVE-2026-78157

The out-of-bounds read in Open5GS PCRF's Rx AA-Request handler (CVE-2026-78157, CVSS 7.4) is a memory safety issue that sits inside the policy decision engine controlling subscriber session QoS, charging rules, and enforcement. The CVSS rating is irrelevant to what matters: this handler sits at the architectural seam between DIAMETER protocol parsing and session state management—a pattern where performance pressures bundled AF-facing Rx logic together with Gx session material and cryptographic primitives. An OOB read at this seam isn't merely a data leak; it's a potential policy poisoning primitive. If an attacker can repeatedly probe adjacent memory through crafted AAR messages, they can reconstruct the session state the PCRF is working with, map the decision engine's policy templates, and identify enforcement gaps in charging or QoS shaping that downstream Gx credit control answers will push to P-GW enforcement points. What you should do: First, verify whether your Open5GS Rx interface enforces mutual TLS and DIAMETER peer authentication on incoming AAR messages—if the transport layer is misconfigured or exposed to semi-trusted network segments, this becomes exploitable rather than theoretical. Second, examine the specific patch commit to determine whether the fix is a narrow bounds check or a refactor of where session material lives relative to the handler's stack frame; if it's the former, treat this as a signal that other Rx/DIAMETER handlers in the same component likely share the same vulnerability class. Third, audit your memory layout: what sits adjacent to the Rx handler's working memory in your deployment configuration? If session metadata or crypto material is reachable from this parsing path, the blast radius extends beyond information disclosure into controllable policy inference. Finally, check whether Open5GS has a pattern of recurring Rx handler fixes in its commit history—if this is the third or fourth similar patch in eighteen months, you're looking at a class failure, not an instance, and patching this single CVE won't prevent the next variant. The systemic question isn't just whether mutual TLS is enabled; it's why parsing logic can reach session state at all, and what review or testing would have caught the missing bounds check before production.

Reviewed through automated stages and approved by a human before publication.