The vulnerability resides in the SGWC component of Open5GS, specifically in the function that handles indirect data forwarding tunnel requests. A crafted request can trigger an assertion failure within the S11 handler, causing the SGWC process to crash. This CWE-617 reachable assertion flaw does not directly provide code execution, but it can lead to service disruption and potentially serve as a foothold for further exploitation if combined with other weaknesses.

Versioned releases of the Open5GS platform through 2.7.6, including all installations that have not applied the latest patch, are affected. The issue is confined to the SGWC component, which processes S11 interface traffic between the SGW and the MME/UPF.

The CVSS score of 6.9 indicates a moderate to high risk, while the EPSS score of less than 1% suggests a low probability of exploitation at this time. The vulnerability is exploitable remotely and has already been publicly disclosed, which raises the likelihood of targeted attacks. Although the flaw primarily leads to denial of service, a remote attacker could leverage repeated crashes to facilitate a denial‑of‑service attack vector or combine it with other vulnerabilities for broader impact. The CVE is not listed in the CISA KEV catalogue, but its potential to disrupt core 5G network functions warrants prompt attention.