This vulnerability in aligungr UERANSIM versions 3.0 through 3.3.0 involves memory corruption triggered by manipulating the dedicatedNASMessage argument in the ULInformationTransfer function of the nr-gnb component. The issue is remotely exploitable without privileges or user interaction. Despite early vendor notification, no fix or advisory has been issued. The CVSS 4.0 base score is 6.9, reflecting medium severity with network attack vector and low attack complexity.

Successful exploitation can lead to memory corruption, potentially causing application instability or enabling further attacks. The vulnerability is remotely exploitable without authentication or user interaction. Public exploit code availability increases the risk, although no active exploitation in the wild has been reported.

No official fix or patch is currently available from the vendor. Users should monitor for vendor advisories and apply updates once released. Until then, consider implementing network-level protections to restrict access to vulnerable components and closely monitor for suspicious activity related to ULInformationTransfer messages.