A flaw in the BIG‑IP Advanced WAF or ASM security policy allows an attacker to send undisclosed requests that cause the bd process to terminate abruptly. The resulting crash leads to a denial of service for the virtual server hosting the WAF or ASM, potentially disrupting network traffic and other services that rely on the protected virtual server. The weakness is identified as CWE‑252, indicating that the process does not properly handle or validate certain inputs.

The vulnerability affects F5 BIG‑IP devices configured with the Advanced Web Application Firewall (WAF) or Application Security Manager (ASM) component. No specific firmware or policy versions are listed, so any installation of those modules remains potentially at risk until a vendor-supplied update is applied.

The CVSS score of 8.7 places this issue in the high severity range, and while the EPSS score is not available, the lack of an EPSS rating does not imply lower risk. The vulnerability is not listed in the CISA KEV catalog, but that does not diminish the requirement for prompt remediation. The attacker likely needs to craft and send HTTP or similar undisclosed requests targeting the virtual server; the exact attack vector is not fully detailed, but the described behavior suggests remote exploitation over the network. Given the high CVSS score and the disruptive impact, this flaw should be treated with high priority.