The vulnerability resides in the PCF component of Open5GS in the function pcf_sess_set_ipv6prefix located in /src/pcf/context.c. Malicious manipulation of the SmPolicyContextData.ipv6AddressPrefix argument can trigger a denial of service in the PCF service. The flaw stems from improper handling of the IPv6 prefix, leading to resource exhaustion or crash. It directly jeopardizes service availability for any subscriber relying on the PCF and can disrupt higher‑layer functions in the 5G core.

Affected are installations of Open5GS up to and including version 2.7.7. The vulnerability applies only to the PCF module; other components of the Open5GS stack are not impacted. Deployment environments running a compromised PCF are vulnerable, especially those exposed to untrusted networks or public interfaces capable of sending custom SmPolicyContextData payloads.

Risk assessment shows a CVSS score of 6.9, indicating a moderate to high severity, with no EPSS score available and not listed in the CISA KEV catalog. The lack of EPSS data limits precise exploitation probability, but the remote nature of the attack and public disclosure indicate a realistic risk. Attackers would need network access to the PCF endpoints and ability to craft a malformed ipv6AddressPrefix field; once successful, the PCF service will become unavailable until a restart or patch is applied.