CVE-2026-33282 affects Ella Core, a 5G core network solution for private networks. Versions prior to 1.6.0 are vulnerable to denial of service attacks through malformed NGAP LocationReport messages. Attackers can send crafted NGAP messages with ue-presence-in-area-of-interest event type while omitting the optional UEPresenceInAreaOfInterestList IE, causing the core process to panic and crash. This results in service disruption for all connected subscribers. No authentication is required to exploit this vulnerability. The issue was fixed in version 1.6.0 by adding IE presence verification to NGAP message handling.