The vulnerability resides in an unknown part of the NGSetupRequest handler in omec-project amf. When an attacker supplies carefully crafted input, a buffer overflow occurs that corrupts memory. This flaw can lead to arbitrary reads or writes, allowing an attacker to compromise confidentiality and integrity of the target system. The description explicitly states that the attack can be performed remotely and the exploit has been publicly disclosed.

All installations of omec-project amf up to and including version 2.1.1 are affected. The flaw is present in an unspecified component of the NGSetupRequest module. No other product versions or vendors are listed as impacted.

The CVSS score of 5.3 indicates moderate risk, and the EPSS score is not available, meaning no data is currently available on exploit frequency. The vulnerability is not listed in CISA KEV, but the exploit has been disclosed to the public, implying potential for active exploitation. The likely attack vector is remote, as the description confirms a remote execution path. Exploitation requires sending malformed NGSetupRequest packets to the vulnerable service, which can be done over the network without local privileges.