The flaw causes an assertion failure within the Protocol Configuration Options parser of the Session Management Function component, triggered by NGAP messages that carry malformed length fields for protocol configuration data; the result is an internal crash of the SMF service, leading to a denial of service for users relying on the affected network element.

All Open5GS deployments that use the SMF component prior to the v2.7.5 release are susceptible, regardless of distribution channel or hosting environment.

Remote attackers who can reach the SMF over the NGAP interface can craft messages that exploit the parsing bug; the vulnerability is not currently listed in the CISA KEV catalog and EPSS information is unavailable, but the remote nature and potential to abort the SMF process imply a high risk of service disruption. No known public exploitation has been reported, yet the absence of a KEV listing does not mitigate the inherent vulnerability due to the ease with which the attack vector can be exercised over the network.