PT-2026-28562 · Ella Core · Ella Core

Published 2026-03-26 · Updated 2026-04-07 · CVE-2026-33903

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Ella Core versions prior to 1.7.0

Description Ella Core, a 5G core designed for private networks, experiences a panic when processing a specifically crafted NGAP LocationReport message. An attacker capable of sending crafted NGAP messages to Ella Core can cause a process crash, leading to service disruption for all connected subscribers. The issue resides in the handling of NGAP Location Report messages.

Recommendations Update to version 1.7.0 or later, which includes guards in the NGAP Location Report handler.

Exploit

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2026-33903

GHSA-F2F3-9CX3-WCMF

GO-2026-4875

SUSE-SU-2026:1205-1

Affected Products

Ella Core

References · 47

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33903.json · Exploit
• https://github.com/ellanetworks/core/commit/ec77a2ad4508f8488cb356fd45b2f1efd92587f8 · Patch
• https://github.com/ellanetworks/core/security/advisories/GHSA-f2f3-9cx3-wcmf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33903 · Security Note
• https://osv.dev/vulnerability/CVE-2026-33903 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-f2f3-9cx3-wcmf · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4875 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1205-1 · Vendor Advisory
• https://github.com/ellanetworks/core · Note
• https://github.com/ellanetworks/core/releases/tag/v1.7.0 · Note
• https://suse.com/security/cve/CVE-2026-33748 · Note
• https://suse.com/security/cve/CVE-2026-34042 · Note
• https://suse.com/security/cve/CVE-2026-34388 · Note
• https://suse.com/security/cve/CVE-2026-34386 · Note
• https://suse.com/security/cve/CVE-2026-34385 · Note