CVE-2026-92417

MediumCVSS 6.5/10Last modified Sep 22, 2026

Description

A vulnerability was found in Open5GS up to 2.8.0. This affects the function ogs_pfcp_parse_volume_measurement in the library lib/pfcp/types.c of the component PFCP Handler. The manipulation results in null pointer dereference. The attack may be launched remotely. The patch is identified as 8f07b507b78ff94776f2cd49276eb116ed93d7f2. A patch should be applied to remediate this issue.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-404CWE-476

Affected software

VendorProductVersions
n/aOpen5GS2.0; 2.1; 2.2; 2.3; 2.4; 2.5; 2.6; 2.7; 2.8.0

References

Timeline

Published
Sep 16, 2026
Last modified
Sep 22, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-924183.5A vulnerability was determined in ChangeWeDer crm up to c07bd4c97141521af6475034bc58523beed51bbd. This vulnerability affects unknown code ofCVE-2026-924195.3WEBCON BPS is vulnerable to Insecure Direct Object Reference (IDOR) in the /api/vacations/{path} endpoint. The selectedPeople parameter in tCVE-2026-92425.3The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to AuthentiCVE-2026-924203.8The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.2 does not verify that a booking belongs to the reCVE-2026-924214.7The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.3 does not verify that the host record being modifCVE-2026-924226.5The Meow Gallery WordPress plugin before 5.5.5 does not properly sanitize a user-supplied value before concatenating it into a shortcode strCVE-2026-924232.7The Meow Gallery WordPress plugin before 5.5.5 does not perform a proper capability check or restrict results to the requesting user's own pCVE-2026-924246.8The Content Egg WordPress plugin before 11.9.0 does not verify that a user running its bulk content-import feature is authorized for the imCVE-2026-924255.5The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.4 does not perform object-level authorisation checCVE-2026-924264.9The YITH WooCommerce Popup WordPress plugin before 1.60.0 does not check the capability of the requesting user before deleting post meta, alCVE-2026-924275.3The Coinsnap Bitcoin Crowdfunding WordPress plugin through 1.2.0 does not restrict access to the secret used to authenticate its payment gatCVE-2026-924285.3The Rede Itaú for WooCommerce WordPress plugin before 5.5.3 does not verify the authenticity of a payment gateway webhook before updating an
CVE-2026-92417: Medium severity, CVSS 6.5 | Vulnix