CVE-2026-78156 is a heap-based buffer overflow vulnerability in Open5GS 2.8.0 affecting the function hss_ogs_diam_s6a_air_cb within src/hss/hss-s6a-path.c. The vulnerability arises from improper handling of the Visited-PLMN-Id argument in the S6a Authentication-Information-Request Handler, allowing remote attackers to cause memory corruption. The vulnerability is tracked as CWE-119. A patch exists identified by commit a9c82ee0b590d76a581b0580cb46b598984e2392, though no direct vendor advisory or patch link is provided in the data.

Successful exploitation can lead to a heap-based buffer overflow, potentially causing partial loss of confidentiality, integrity, and availability of the affected system. The CVSS v3.1 score is 7.4 (High), with attack vector network, low attack complexity, requiring low privileges and no user interaction, and scope changed. There are no known exploits in the wild at this time.

A patch identified by commit a9c82ee0b590d76a581b0580cb46b598984e2392 should be applied to remediate this vulnerability. Since no official vendor advisory or patch link is provided, users should verify the availability of this patch in the Open5GS project repository or official channels. Patch status is not yet confirmed via vendor advisory; check the vendor repository for current remediation guidance.