# CVE-2022-39063

## Summary

- **CVE ID:** CVE-2022-39063
- **Severity:** UNKNOWN
- **CVSS Score:** 0.02
- **CWE:** CWE-676
- **Published:** Sep 16, 2022
- **Last Modified:** Mar 13, 2026

## Description

When Open5GS UPF receives a PFCP Session Establishment Request, it stores related values for building the PFCP Session Establishment Response. Once UPF receives a request, it gets the f_teid_len from incoming message, and then uses it to copy data from incoming message to struct f_teid without checking the maximum length. If the pdi.local_f_teid.len exceeds the maximum length of the struct of f_teid, the memcpy() overwrites the fields (e.g., f_teid_len) after f_teid in the pdr struct. After parsing the request, the UPF starts to build a response. The f_teid_len with its overwritten value is used as a length for memcpy(). A segmentation fault occurs, as a result of a memcpy(), if this overwritten value is large enough.

## Affected Products

- Open5GS — Open5GS (<2.4.9)

## References

- [CNA](https://www.synopsys.com/blogs/software-security/cyrc-advisory-open5gs/)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.59%
- **EPSS Percentile:** 68.8

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-10._