The vulnerability is a heap out-of-bounds read in the function ogs_pfcp_parse_dropped_dl_traffic_threshold() within Open5GS. Attackers can craft PFCP Session Establishment or Modification Requests with DLPA and DLBY flags set, which forces the parser to read past the allocated IE buffer. This flaw allows an unauthenticated remote user to read memory contents that lie outside the intended bounds, potentially exposing sensitive data or causing the UPF to crash. The weakness is classified as CWE-125.

Affected are Open5GS deployments using any version up through and including 2.8.0. The vulnerability exists in the open-source Open5GS project that runs on the User Plane Functions (UPFs) handling PFCP messages.

The CVSS score of 6.9 indicates a moderate severity, and the EPSS score is not available, meaning the exploitation likelihood cannot be quantified from public data. However, the flaw is exploitable over the public internet on UDP port 8805 without authentication, meaning that malicious actors can trigger the out-of-bounds read from any remote host. While the vulnerability is not listed in a KEV catalog, it remains a practical risk for deployments that expose PFCP to untrusted networks.