CVE-2026-2517

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A security flaw has been discovered in Open5GS up to 2.7.6. This vulnerability affects the function ogs_gtp2_parse_tft in the library lib/gtp/v2/types.c of the component SMF. Performing a manipulation of the argument pf[0].content.length results in denial of service. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-404

Affected software

No affected versions have been published.

Timeline

Published
Feb 15, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-251707.0Use after free in Windows Hyper-V allows an authorized attacker to elevate privileges locally.CVE-2026-251717.0Use after free in Windows Authentication Methods allows an authorized attacker to elevate privileges locally.CVE-2026-251728.0Integer overflow or wraparound in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to execute code over a netwCVE-2026-251738.0Integer overflow or wraparound in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to execute code over a netwCVE-2026-251747.8Out-of-bounds read in Windows Extensible File Allocation allows an authorized attacker to elevate privileges locally.CVE-2026-251757.8Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally.CVE-2026-251767.8Improper access control in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.CVE-2026-251778.8Improper restriction of names for files and other resources in Active Directory Domain Services allows an authorized attacker to elevate priCVE-2026-251787.0Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.CVE-2026-251797.0Improper validation of specified type of input in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate priCVE-2026-25184.3The FastX theme for WordPress is vulnerable to unauthorized limited plugin installation and activation due to missing capability checks on tCVE-2026-251805.5Out-of-bounds read in Microsoft Graphics Component allows an unauthorized attacker to disclose information locally.
CVE-2026-2517: High severity, CVSS 7.5 | Vulnix