CVE-2026-9299 is a memory corruption vulnerability in the omec-project amf product affecting versions 2.1.0 and 2.1.1. The issue resides in the PDUSessionResourceModifyIndication function within the /go/src/amf/ngap/handler.go file. This flaw can be exploited remotely without user interaction and with low privileges, potentially leading to memory corruption. Although an exploit has been published, there is no confirmed vendor patch or official remediation guidance available at this time.

Successful exploitation of this vulnerability can cause memory corruption in the affected component, which may lead to application instability or potential code execution. The CVSS 4.0 base score of 5.3 indicates a medium severity impact with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The vulnerability affects confidentiality, integrity, and availability to a low extent.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Applying a patch is recommended once available. Until then, monitor vendor communications for updates. No official fix or temporary workaround has been provided by the vendor as of the current information.