A memory corruption flaw exists in omec-project AMF, affecting the PDUSessionResourceModifyIndication handler for all versions up to 2.1.1. The vulnerability allows an attacker to supply crafted input that triggers a buffer overflow, corrupting memory on the server. While the description confirms that remote exploitation is possible, it does not explicitly state that arbitrary code execution is guaranteed; however, memory corruption could lead to unexpected behavior or loss of integrity.

The affected product is omec-project AMF. Any deployment running version 2.1.1 or earlier is vulnerable; upgrades beyond 2.1.1 are presumed to contain a fix.

The CVSS score of 5.3 classifies the issue as moderate severity. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, yet an exploit has been published and could be leveraged in real attacks. The likely attack vector is remote, involving network traffic that triggers the PDUSessionResourceModifyIndication interface; therefore, systems exposed to external networks are at risk.