This vulnerability (CWE-122) in F5 BIG-IP arises from a heap-based buffer overflow triggered by specific malicious traffic when both a BIG-IP APM access policy and an OAuth profile are configured on a virtual server. Exploitation can lead to remote code execution without authentication. The flaw affects the data plane only, with no control plane exposure. The affected versions explicitly include 17.1.0, 17.5.0, and 21.1.0. The CVSS v3.1 base score is 9.8, indicating critical severity with network attack vector, low attack complexity, no privileges or user interaction required, and full confidentiality, integrity, and availability impact.

An unauthenticated attacker can remotely execute arbitrary code on the vulnerable BIG-IP system, including those running in Appliance mode. This can lead to full compromise of the affected system's data plane. There is no impact on the control plane. The vulnerability poses a critical risk due to the ease of exploitation and the severity of potential consequences.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or workaround information is provided in the available data. Users should monitor F5's official advisories for updates and apply patches promptly once available. Until then, consider mitigating exposure by reviewing configurations involving BIG-IP APM access policies and OAuth profiles.