This vulnerability in Open5GS affects the ogs_sbi_client_send_via_scp_or_sepp function in the lib/sbi/client.c file of the NF component. It allows an attacker to perform an out-of-bounds read remotely, potentially leading to information disclosure or application instability. The affected versions include all releases from 2.7.0 through 2.7.7. A patch commit has been referenced (d5bc487fcf9ea87d2b03f2ef95123af344773bfb), but no vendor advisory or official remediation level is provided in the available data. The CVSS 4.0 base score is 6.9, indicating medium severity with network attack vector, low attack complexity, no privileges or user interaction required, and limited impact on availability.

The vulnerability allows remote attackers to cause an out-of-bounds read in Open5GS NF component, which may lead to information disclosure or application instability. There is no evidence of known exploits in the wild. The medium CVSS score reflects a moderate risk level without direct evidence of code execution or denial of service.

A patch addressing this vulnerability has been identified (commit d5bc487fcf9ea87d2b03f2ef95123af344773bfb). Security teams should apply this patch to affected Open5GS versions (2.7.0 through 2.7.7) to remediate the issue. Since no official vendor advisory or remediation level is provided, verify with the Open5GS project or trusted sources for the latest patch availability and instructions. Until patched, consider restricting network exposure of the affected component if feasible.