The AMF component of omec‑project contains a flaw in its NGAP Message Handler that allows malformed NGAP messages to cause memory corruption. This weakness is a classic buffer overflow described by CWE‑119 and can lead to unpredictable program state if exploited. The official description does not state whether the corruption can trigger arbitrary code execution, so the impact stops at memory corruption without a confirmed RCE outcome.

All installations of omec‑project amf with versions up through 2.1.1 are known to be vulnerable; versions 2.2.0 and later contain the fix and are not affected.

The CVSS base score of 5.3 indicates a moderate severity. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, although a publicly available exploit exists. Based on the description, it is inferred that the attack can be launched remotely by sending crafted NGAP messages over the network. The exploit does not require local privileges, so any networked attacker who can reach the AMF interface is a potential threat.