Open5GS 2.7.7 is vulnerable due to a use‑after‑free flaw in the amf_context_final function of the AMF component, identified as CWE‑416 and CWE‑119. The defect allows a local attacker who manipulates the AMF context to trigger a free followed by reuse of the same memory, potentially leading to arbitrary code execution or crashing the AMF process. The CVSS score of 4.8 indicates a medium severity that reflects the local scope of the attack, while the presence of a publicly released exploit increases the urgency.

Vulnerable deployments are those running Open5GS 2.7.7. Earlier releases that ship the same amf_context_final code may also be affected, but the CVE description specifically confirms the issue in version 2.7.7.

The flaw requires local access to the host running Open5GS; remote attackers cannot directly exploit it. The EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Nonetheless, because an exploit is publicly available, a privileged local actor could compromise the AMF process, which is a critical element of 5G core network operations.