CVE-2026-78156

The heap-based buffer overflow in Open5GS's S6a handler (hss_ogs_diam_s6a_air_cb) stems from insufficient bounds checking when parsing the Visited-PLMN-Id AVP. The PLMN-Id carries MCC/MNC network identity information that must be nibble-packed into variable-length fields per 3GPP specifications, and when these encoded values reach the Diameter application's handler layer without adequate validation, the result is heap corruption. What makes this actionable is the attack surface: the S6a interface runs over the inter-operator Diameter network, meaning any entity with Diameter connectivity—a rogue or compromised MME, or an attacker with MITM positioning on the interconnect—can inject malformed PLMN-Ids toward a vulnerable HSS. The CVSS 7.4 reflects both the network accessibility and the memory corruption potential. Immediate priorities: verify your Open5GS version (2.8.0 is affected), apply the patch from commit a9c82ee0b590d76a581b0580cb46b598984e2392, and audit other Diameter handlers for similar validation gaps. More critically, examine whether your Open5GS deployment has centralized input validation at the Diameter-to-application boundary or if each handler owns its own bounds checking independently—this architectural question determines whether other PLMN-Id consumers (GTP, S1AP, NAS handlers) likely share this vulnerability class. The deeper concern: the HSS gates authentication for every subscriber routed through it. A buffer overflow here doesn't just crash a process—it can corrupt the authentication vectors fed to downstream network elements, propagating bad state across access decisions. That's a different blast radius than a typical web server overflow, and it means the patching timeline matters more than CVSS suggests. In telecom infrastructure, change windows and fallback validation create operational lag between patch availability and deployment—and that gap is the real exposure window.

Reviewed through automated stages and approved by a human before publication.