The flaw causes an assertion failure within the Protocol Configuration Options parser of the Session Management Function component, triggered by NGAP messages that carry malformed length fields for protocol configuration data; the result is an internal crash of the SMF service, leading to a denial of service for users relying on the affected network element.

All Open5GS deployments that use the SMF component prior to the v2.7.5 release are susceptible, regardless of distribution channel or hosting environment.

Remote attackers who can reach the SMF over the NGAP interface can send specially crafted NGAP messages with malformed length fields, triggering the parser to assert and crash the SMF. The bug carries a CVSS score of 7.5, indicating high severity, and an EPSS score of less than 1% suggests a low current exploitation probability, though the remote nature and lack of any perceived mitigations mean that a successful attack could immediately disrupt network services. The vulnerability is not listed in the CISA KEV catalog, but the ease of exploitation over the network makes it a significant risk if left unpatched.