The vulnerability is a heap out‑of‑bounds read in the PFCP Volume Measurement IE parsing code of Open5GS version 2.8.0. An attacker can send a crafted PFCP Session Report Request containing a short, all‑flags Volume Measurement IE. The parsing routine reads up to 48 bytes past the intended buffer, exposing adjacent memory contents and potentially leading to a service crash. This type of flaw can compromise confidentiality of sensitive data stored nearby the heap and disrupt the operation of the SMF, causing denial of service in the network element but does not grant remote code execution or higher privileges.

Affected product: Open5GS (open5gs:open5gs) through version 2.8.0. No other vendor or product versions are listed. The component impacted is the PFCP handling code located in lib/pfcp/types.c.

The CVSS score of 6.9 indicates moderate severity, and EPSS data is not available, so the probability of exploitation cannot be quantified from public data. The flaw is not listed in the CISA KEV catalog, implying no known widespread exploitation at this time. The likely attack vector is remote and unauthenticated: an attacker can issue the malicious PFCP message to the SMF listening on UDP port 8805. If successful, the attacker may read sensitive memory and cause the SMF to crash, potentially affecting downstream network services.