A flaw in the smf_nsmf_handle_create_sm_context routine of Open5GS's SMF component can be triggered through crafted input, causing the SMF to crash and result in a denial of service. The vulnerability permits remote exploitation, meaning an external adversary can trigger the crash from outside the controlled environment. The impact is limited to availability, as there is no evidence of data disclosure or code execution.

All installations of the Open5GS project using version 2.7.7 or earlier are vulnerable. The affected product is Open5GS SMF, which is used to manage user sessions in 5G core networks. No narrower version range is specified, so the standard practice is to assume all releases up to and including 2.7.7 are at risk.

The CVSS score of 5.3 indicates a moderate severity level, while the EPSS score is not available and the vulnerability is not listed in CISA KEV. Remote exploitation is possible, and the existence of a public exploit suggests that opportunistic attackers could readily compromise the SMF control plane. The likely attack vector is through a remote, unauthenticated network connection to the SMF endpoint; this is inferred from the description since the exact path is not explicitly detailed.