This vulnerability in Open5GS (up to version 2.7.7) involves the pcf_npcf_smpolicycontrol_handle_delete function within the src/pcf/sm-sm.c file. Remote attackers can manipulate this function to cause a denial of service condition. The issue was reported early to the project but remains unaddressed. The CVSS 4.0 base score is 6.9, indicating a medium severity with network attack vector, no privileges required, and no user interaction needed. No patch or official fix has been published, and the software is not a cloud service, so remediation depends on the vendor releasing an update.

Successful exploitation results in denial of service, potentially disrupting the availability of the affected Open5GS component. The attack can be launched remotely without authentication, increasing the risk of service interruption. There is no indication of data confidentiality or integrity impact. No known exploits are reported in the wild beyond the publicly available proof-of-concept.

As of now, no official patch or remediation has been provided by the Open5GS project. Users should monitor the vendor's communications for updates and apply any future patches promptly. In the absence of a fix, consider restricting network access to the affected component to trusted sources to reduce exposure. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.