The vulnerability originates in the Open5GS Rx AA‑Request handler, where the function pcrf_rx_aar_cb performs an out‑of‑bounds read. A malformed AA‑Request can cause the code to read data beyond the intended buffer, potentially exposing sensitive information stored in memory. While the flaw does not provide remote code execution, it can lead to information disclosure if an attacker can supply the triggering request from outside the network.

This issue affects the Open5GS open source project, specifically the 2.8.0 release. No other versions were listed as affected in the CVE details; therefore, if you are running a different release, confirm whether the same code path exists, but the patch commit references the 2.8.0 code base.

The CVSS score of 5.3 indicates a medium severity vulnerability, and the EPSS score is not available while the vulnerability is not listed in the CISA KEV catalog. Attackers can trigger the out‑of‑bounds read remotely by sending a crafted AA‑Request to the Open5GS service, making the threat realistic for exposed deployments. Even though it does not result in code execution, the potential information disclosure warrants timely remediation.