102 matches found
PT-2026-37450
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists between client drivers and the MHI stack due to the auto queue feature, which automatically queues buffers for the RX path DL channel. This can cause the dl...
CVE-2025-54324
An issue was discovered in NAS in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 2500, 9110, W920, W930, W1000, Modem 5123, Modem 5300, and Modem 5400. Incorrect Handling of a DL NAS Transport packet leads to a...
CVE-2025-66363
An issue was discovered in LBS in Samsung Mobile Processor Exynos 2200. There was no check for memory initialization within DL NAS Transport messages...
EUVD-2025-208236
An issue was discovered in LBS in Samsung Mobile Processor Exynos 2200. There was no check for memory initialization within DL NAS Transport messages...
CVE-2025-66363
An issue was discovered in LBS in Samsung Mobile Processor Exynos 2200. There was no check for memory initialization within DL NAS Transport messages...
NULL Pointer Dereference
Overview Affected versions of this package are vulnerable to NULL Pointer Dereference via the PFCP SessionReportRequest process when ReportType.DLDR is set but the DownlinkDataReport information element is missing. An attacker can cause the process to terminate unexpectedly by sending a specially...
NULL Pointer Dereference
Overview Affected versions of this package are vulnerable to NULL Pointer Dereference via the PFCP SessionReportRequest process when ReportType.DLDR is set but the DownlinkDataReport information element is missing. An attacker can cause the process to terminate unexpectedly by sending a specially...
CVE-2026-25501 free5GC SMF crash (nil pointer dereference) on PFCP SessionReportRequest when ReportType.DLDR is set but DownlinkDataReport IE is missing
free5GC SMF provides Session Management Function for free5GC, an open-source project for 5th generation 5G mobile core networks. In versions up to and including 1.4.1, SMF panics due to nil pointer dereference and the SMF process terminates. This is triggered by a malformed PFCP...
CVE-2026-25501
Free5GC SMF (Session Management Function) up to version 1.4.1 is vulnerable to a nil pointer dereference that causes the SMF process to panic when processing a malformed PFCP SessionReportRequest on the PFCP interface (UDP/8805). The issue can lead to SMF termination. There is no known upstream f...
CVE-2026-25501 free5GC SMF crash (nil pointer dereference) on PFCP SessionReportRequest when ReportType.DLDR is set but DownlinkDataReport IE is missing
free5GC SMF provides Session Management Function for free5GC, an open-source project for 5th generation 5G mobile core networks. In versions up to and including 1.4.1, SMF panics due to nil pointer dereference and the SMF process terminates. This is triggered by a malformed PFCP...
CVE-2026-25501 free5GC SMF crash (nil pointer dereference) on PFCP SessionReportRequest when ReportType.DLDR is set but DownlinkDataReport IE is missing
free5GC SMF provides Session Management Function for free5GC, an open-source project for 5th generation 5G mobile core networks. In versions up to and including 1.4.1, SMF panics due to nil pointer dereference and the SMF process terminates. This is triggered by a malformed PFCP...
CVE-2025-15539
A vulnerability was determined in Open5GS up to 2.7.6. Impacted is the function sgwcs11handledownlinkdatanotificationack of the file src/sgwc/s11-handler.c of the component sgwc. This manipulation causes denial of service. The attack can be initiated remotely. The exploit has been publicly...
CVE-2025-15539
A vulnerability was determined in Open5GS up to 2.7.6. Impacted is the function sgwcs11handledownlinkdatanotificationack of the file src/sgwc/s11-handler.c of the component sgwc. This manipulation causes denial of service. The attack can be initiated remotely. The exploit has been publicly...
CVE-2025-15539
Open5GS up to 2.7.6 is affected by a Denial of Service vulnerability in the sgwc component. The issue is in the function sgwc_s11_handle_downlink_data_notification_ack (src/sgwc/s11-handler.c), which can be triggered remotely. The exploit has been publicly disclosed and may be utilized. Red Hat a...
CVE-2025-15539 Open5GS sgwc s11-handler.c sgwc_s11_handle_downlink_data_notification_ack denial of service
A vulnerability was determined in Open5GS up to 2.7.6. Impacted is the function sgwcs11handledownlinkdatanotificationack of the file src/sgwc/s11-handler.c of the component sgwc. This manipulation causes denial of service. The attack can be initiated remotely. The exploit has been publicly...
CVE-2025-15539 Open5GS sgwc s11-handler.c sgwc_s11_handle_downlink_data_notification_ack denial of service
A vulnerability was determined in Open5GS up to 2.7.6. Impacted is the function sgwcs11handledownlinkdatanotificationack of the file src/sgwc/s11-handler.c of the component sgwc. This manipulation causes denial of service. The attack can be initiated remotely. The exploit has been publicly...
CVE-2025-15539 Open5GS sgwc s11-handler.c sgwc_s11_handle_downlink_data_notification_ack denial of service
A vulnerability was determined in Open5GS up to 2.7.6. Impacted is the function sgwcs11handledownlinkdatanotificationack of the file src/sgwc/s11-handler.c of the component sgwc. This manipulation causes denial of service. The attack can be initiated remotely. The exploit has been publicly...
PT-2026-3405
Name of the Vulnerable Software and Affected Versions Open5GS versions through 2.7.6 Description A flaw exists in Open5GS that can lead to a denial of service. The issue is located in the sgwc s11 handle downlink data notification ack function within the src/sgwc/s11-handler.c file of the sgwc...