This vulnerability is a stack-based buffer overflow (CWE-121) in the Traffic Management Microkernel (TMM) component of F5 BIG-IP when a classification profile is configured on a UDP virtual server. Certain undisclosed requests can trigger the overflow, causing TMM to terminate unexpectedly. The affected versions are 16.1.0, 17.1.0, and 17.5.0. The CVSS 3.1 base score is 7.5, reflecting a high severity with network attack vector, low attack complexity, no privileges or user interaction required, and impact limited to availability (denial of service). The vendor has not provided a patch or official remediation level, and the software versions that have reached End of Technical Support are not evaluated. No known exploits are currently reported.

The vulnerability causes the Traffic Management Microkernel (TMM) to terminate, resulting in a denial of service (availability impact) on affected F5 BIG-IP devices. There is no reported impact on confidentiality or integrity. This could disrupt network traffic management functions relying on the affected UDP virtual server configuration.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or workaround is currently provided, users should monitor F5's advisories for updates. Until a patch is available, consider avoiding the use of classification profiles on UDP virtual servers if feasible, or implement compensating controls to limit exposure. No generic or unrelated mitigations are recommended at this time.