PT-2026-123397

Open5GS 2.6.1 through 2.8.0 contains an out-of-bounds read vulnerability in parse scheme output in lib/sbi/conv.c during SUCI de-concealment due to incomplete length validation. Remote unauthenticated UEs or SBI peers can submit a crafted SUCI with a 42-byte scheme output to a UDM, triggering a...