This vulnerability affects Open5GS up to version 2.7.7 in the handle_scp_info function of the lib/sbi/nnrf-handler.c file, specifically in the Shared NF-profile Parser component. It allows an attacker to cause an out-of-bounds write remotely, potentially leading to memory corruption. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and limited impact on availability. Although the exploit has been publicly disclosed, there is no indication of active exploitation in the wild. No official patch or remediation level has been published yet.

The vulnerability can be exploited remotely to cause an out-of-bounds write, which may lead to memory corruption and potentially impact the stability or security of the Open5GS service. The CVSS score indicates a medium severity impact with limited availability impact and no direct confidentiality or integrity loss reported.

A patch is recommended to address this vulnerability; however, no official fix or vendor advisory confirming patch availability is currently provided. Users should monitor the Open5GS project or vendor communications for an official patch or update. Until then, consider applying any available workarounds or mitigations from trusted sources. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.