The flaw resides in src/mme/esm-build.c in Open5GS versions up to 2.7.6. It allows an attacker to manipulate an unknown function that results in memory corruption, which could enable arbitrary code execution or service disruption and affect the confidentiality, integrity, or availability of the 5G core network. The weakness is classified as CWE-119, a classic buffer access or manipulation vulnerability.

Vendors: Open5GS. Product: the MME component of the Open5GS 5G core network. Versions up to and including 2.7.6 are affected; no patch has been released yet.

CVSS score 6.9 indicates moderate severity. The EPSS score is less than 1%, suggesting a low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote; an attacker would need to send specially crafted traffic to the MME service to trigger the memory corruption. Because the flaw remains unpatched, systems that expose the MME to external networks face higher risk and should monitor for suspicious activities while awaiting a fix.