CVE-2026-32319 is an out-of-bounds read vulnerability classified under CWE-125 affecting Ella Core, a 5G core network solution tailored for private network deployments. The flaw exists in versions prior to 1.5.1, where the core software panics when it processes a malformed NGAP (Next Generation Application Protocol) or NAS (Non-Access Stratum) message that is integrity protected but has a length under 7 bytes. This malformed message triggers an out-of-bounds read condition, causing the core process to crash. Since the core is responsible for managing subscriber sessions and connectivity, this crash results in a denial of service affecting all connected subscribers. The vulnerability can be exploited remotely by an attacker capable of sending crafted NAS messages without requiring any authentication or user interaction, increasing the attack surface significantly. The CVSS v3.1 base score is 7.5, reflecting high severity due to network attack vector, no privileges required, no user interaction, and high impact on availability. The vulnerability does not impact confidentiality or integrity directly but severely impacts service availability. The issue was fixed in version 1.5.1 of Ella Core. No public exploit code or active exploitation has been reported yet, but the ease of exploitation and impact make it a critical patching priority for affected organizations.

The primary impact of CVE-2026-32319 is a denial of service condition in 5G private networks using vulnerable versions of Ella Core. By crashing the core process, attackers can disrupt all subscriber connectivity managed by the core, leading to service outages. This can affect enterprise environments relying on private 5G for critical operations, including manufacturing, logistics, healthcare, and smart infrastructure. The lack of authentication requirement means attackers can exploit this remotely, potentially from outside the network perimeter if message access is not tightly controlled. The disruption could lead to operational downtime, financial losses, and reputational damage. Additionally, repeated exploitation attempts could cause persistent instability. Although confidentiality and integrity are not directly compromised, the availability impact alone is significant for organizations depending on continuous 5G connectivity.

Organizations using Ella Core versions prior to 1.5.1 should immediately upgrade to version 1.5.1 or later to remediate this vulnerability. Until patching is complete, network administrators should implement strict filtering and validation of NGAP/NAS messages at network boundaries to block malformed or suspicious messages, particularly those with lengths under 7 bytes. Deploying anomaly detection systems to monitor for unusual NAS message patterns can help identify exploitation attempts. Network segmentation and limiting exposure of the core network to untrusted sources reduce the attack surface. Additionally, applying rate limiting on NAS message processing can mitigate the impact of repeated malformed message attempts. Regularly auditing and updating 5G core components and maintaining close coordination with the vendor for security advisories is essential. Finally, incident response plans should include procedures for rapid recovery from core process crashes to minimize downtime.