The vulnerability arises from improper handling of syntactically invalid structures within the Ericsson Packet Core Controller. An attacker can send a large volume of specially crafted messages that the controller processes, leading to resource exhaustion and degraded service. This results in a denial‑of‑service condition, as the affected system may become unable to process legitimate traffic. The weakness aligns with CWE‑228, which addresses improper validation of input leading to resource depletion.

Affected products include Ericsson Packet Core Controller (PCC) versions earlier than 1.38. The exposure applies to all installations that run these earlier releases, regardless of deployment size or geographic region, as the flaw is in the core message handling layer. No further version granularity is provided in the advisory.

The CVSS score of 5.3 places the issue in the moderate range, but the EPSS value of less than 1% indicates a very low likelihood of exploitation in the wild. The advisory does not list the vulnerability in CISA's KEV catalog, further suggesting that active exploitation is not widespread. Based on the description, the likely attack vector is remote access to the controller over the network by sending malformed packets; no local privilege escalation is required.