The vulnerability exists in oma versions before 1.25.2, specifically in the oma-topics component responsible for fetching and registering Topic Manifest metadata from remote repository servers. The 'name' field in this metadata was not properly checked for transliteration or CRLF injection, allowing an attacker to craft a malformed Topic Manifest. This malformed data can cause malicious APT source entries to be appended to /etc/apt/sources.list.d/atm.list, potentially enabling the installation of untrusted packages. The issue is classified as CWE-93 (Improper Neutralization of CRLF Sequences).

If exploited, this vulnerability allows an attacker to inject malicious APT source entries into the system's package manager configuration. This could lead to the system downloading and installing packages from attacker-controlled repositories, potentially compromising system integrity. The CVSS 4.0 base score is 5.2 (medium severity), reflecting network attack vector, high attack complexity, and required privileges and user interaction.

This vulnerability is fixed in oma version 1.25.2. Users should upgrade to version 1.25.2 or later to remediate this issue. No other official remediation or temporary fixes are documented. Patch status is not explicitly confirmed beyond the stated fix version, so users should verify with the vendor advisory for the latest guidance.