CVE-2025-29632

Author: HanyiLuo, Yuqi Huo CVE-2025-29632 关于CVE-2025-29632所涵盖漏洞的信息 受影响版本：4.0.0及更早版本 当free5gc处理InitialUEMessage时，它只检查nASPDU引用是否为nil（即是否为空指针），但未验证nASPDU的内容是否为空。这导致在后续消息解析中调用nassecurity.DecodePlainNasNoIntegrityChecknASPDU.Value时，传递了一个空的字节数组作为参数。在该函数中，由于值为空，访问NAS消息安全头失败，从而导致AMF出错并崩溃。 poc.py：一个利用脚本...

CVE-2026-82548

A vulnerability was determined in Linux Foundation Magma 1.9.0. The impacted element is an unknown function of the component InitialUEMessage Handler. This manipulation causes information disclosure. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized...

EUVD-2026-68264

A vulnerability was determined in Linux Foundation Magma 1.9.0. The impacted element is an unknown function of the component InitialUEMessage Handler. This manipulation causes information disclosure. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized...

CVE-2026-82548 Linux Foundation Magma InitialUEMessage information disclosure

A vulnerability was determined in Linux Foundation Magma 1.9.0. The impacted element is an unknown function of the component InitialUEMessage Handler. This manipulation causes information disclosure. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized...

CVE-2026-82548 Linux Foundation Magma InitialUEMessage information disclosure

A vulnerability was determined in Linux Foundation Magma 1.9.0. The impacted element is an unknown function of the component InitialUEMessage Handler. This manipulation causes information disclosure. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized...

CVE-2026-82548

CVE-2026-82548 affects Linux Foundation Magma 1.9.0 , specifically an unknown function within the InitialUEMessage Handler component. The vulnerability enables remote information disclosure with no required privileges or user interaction, rated CVSS 3.1: 5.3 (Medium) . The exploit has been public...

GO-2026-4692 Ella Core vulnerable to Unauthenticated AMF DoS via malformed InitialUEMessage with undersized integrity-protected NAS payload in github.com/ellanetworks/core

Ella Core vulnerable to Unauthenticated AMF DoS via malformed InitialUEMessage with undersized integrity-protected NAS payload in github.com/ellanetworks/core...

CVE-2026-32319

CVE-2026-32319 affects Ella Core (5G private-net core). The issue arises when processing a malformed integrity-protected NGAP/NAS message shorter than 7 bytes, which can cause the Ella Core process to panic and crash, enabling unauthenticated DoS and service disruption for all connected subscribe...

Ella Core vulnerable to Unauthenticated AMF DoS via malformed InitialUEMessage with undersized integrity-protected NAS payload

Summary Ella Core panics when processing a malformed integrity protected NGAP/NAS message with a length under 7 bytes. Impact An attacker able to send crafted NAS messages to Ella Core can crash the process, causing service disruption for all connected subscribers. No authentication is required...

Exploit for Classic Buffer Overflow in Free5Gc

CVE-2025-29632 the information for the vulnerability covered b...

CVE-2024-24449

An uninitialized pointer dereference in the NasPdu::NasPdu component of OpenAirInterface CN5G AMF up to v2.0.0 allows attackers to cause a Denial of Service DoS via a crafted InitialUEMessage message sent to the AMF...

CVE-2024-24449

An uninitialized pointer dereference in the NasPdu::NasPdu component of OpenAirInterface CN5G AMF up to v2.0.0 allows attackers to cause a Denial of Service DoS via a crafted InitialUEMessage message sent to the AMF...

CVE-2024-24449

CVE-2024-24449 arises from an uninitialized pointer dereference in the NasPdu::NasPdu component of OpenAirInterface CN5G AMF (versions up to 2.0.0). This flaw can enable a Denial of Service (DoS) via a crafted InitialUEMessage sent to the AMF. The issue is observable from a network contact point ...

Design/Logic Flaw

An issue was discovered in open5gs v2.6.6. InitialUEMessage, Registration request sent at a specific time can crash AMF due to incorrect error handling of NudmUECMRegistration response...