The vulnerability resides in the pcf_sess_sbi_discover_and_send function of Open5GS's sm-policies endpoint. An attacker can supply a crafted request that causes the function to crash or hang, resulting in a denial of service against the endpoint. Evidence from the CVE description indicates that exploitation is possible remotely and the exploit code has already been made public.

Open5GS (software vendor Open5GS), specifically all releases up to version 2.7.7. The sm‑policies component of the 5G Core network is affected. Systems running those versions that expose the sm‑policies endpoint are potentially vulnerable.

The CVSS score of 6.9 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not currently listed in the CISA KEV catalog, but the existence of a publicly available exploit and the remote nature of the attack increase the risk of real‑world attacks. The likely attack vector is over the network, targeting the sm‑policies endpoint through the 5G Core protocol stack.