Open5GS up to version 2.7.7 has an out-of-bounds read in the NF component's function ogs_sbi_client_send_via_scp_or_sepp in lib/sbi/client.c. The flaw allows an attacker to read memory beyond a buffer boundary, potentially exposing sensitive data. This vulnerability is marked as CWE-119 and CWE-125, indicating classic memory corruption leading to information disclosure. The exploitation vector is remote, meaning an attacker can trigger it from a distant location without local access.

The affected product is Open5GS, specifically the NF component in all releases up to and including 2.7.7. Users running any of these versions should update to a fixed release or apply the patch identified by commit d5bc487fcf9ea87d2b03f2ef95123af344773bfb.

The CVSS base score is 6.9, reflecting a moderate to high severity due to remote access and significant potential for data disclosure. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, indicating that it may not yet be widely exploited. An attacker would need to send crafted requests to the NF service, which must be reachable over the network, to trigger the read. Because the flaw is remote, the risk is heightened for systems exposing the NF component to untrusted networks.