Heap buffer overflow in rsyslog's RainerScript `replace()` function allows unauthenticated remote attackers to crash affected systems by sending crafted syslog messages. The root cause is an incorrect buffer size calculation (CWE-131) during string replacement, leading to heap memory corruption and reliable denial of service. This affects rsyslog as shipped across Red Hat Enterprise Linux versions 6 through 10; no public exploit or CISA KEV confirmation exists at time of analysis.
DNS rebinding in tiger-slack's MCP HTTP transport exposes the locally running Slack MCP server to attacker-controlled browser requests. The root cause is that `mcp/src/httpServer.ts` invoked `httpServerFactory` without enabling the SDK's host allow-list option, leaving the server willing to honor any Host header value and making it trivially reachable via a DNS rebinding attack. Exploitation requires user interaction and a locally running tiger-slack instance; no public exploit code and no CISA KEV listing exist at time of analysis.
Unbounded memory exhaustion in Ruby's resolv gem (before 0.7.2) allows an attacker controlling DNS responses to permanently grow a target process's memory without limit, eventually crashing the service. The root cause is that Resolv::DNS::Resource.get_class and related methods register a new Ruby class as a constant for each unknown DNS resource record type/class pair encountered, preventing garbage collection for the lifetime of the process. Because resolv is a default Ruby gem requiring no installation step, any plain Ruby installation performing DNS resolution - web services, workers, CLI tools - is exposed without opt-in configuration, and no public exploit has been identified at time of analysis.
CodeMeter Runtime in server mode crashes when processing crafted network requests using opcode 0x5e with a malformed data length field, allowing remote unauthenticated attackers to trigger an out-of-bounds read and segmentation fault. Wibu-Systems versions before 8.41a and 9.10 are confirmed affected. The impact is a full service crash, denying access to any software whose licensing depends on the CodeMeter Runtime server - no public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Remote code execution in Spring Integration allows a remote, unauthenticated attacker to run arbitrary code on applications that expose the SerializingHttpMessageConverter on an inbound HTTP endpoint. The converter reads any request body sent with Content-Type application/x-java-serialized-object through a raw java.io.ObjectInputStream.readObject() with no allow-list or class filtering, so if any known Java deserialization gadget is present on the application classpath it can be chained to code execution. No public exploit is identified at time of analysis, but EPSS places it in the 88th percentile (3.44%) and the vulnerability class is well-understood, making it a high-priority patch for exposed deployments.
Denial-of-service in Undertow's WebSocket permessage-deflate implementation allows unauthenticated remote attackers to exhaust server memory by sending specially crafted compressed WebSocket messages. The root cause is exponential buffer doubling in the PerMessageDeflateFunction.largerBuffer() method (CWE-770), which triggers unbounded memory allocation with no confirmation of active exploitation at time of analysis. Affected deployments span a broad Red Hat ecosystem including JBoss EAP 7/8, Red Hat Data Grid 8, Apache Camel for Spring Boot 4, and RHEL 8/9/10 packages that bundle Undertow.
Unauthenticated sensitive data exposure in the SureFeedback Client Site WordPress plugin (≤1.2.12) permits remote attackers to retrieve subscriber-level confidential data without any credentials. The root cause is CWE-862 (Missing Authorization), meaning the plugin exposes data endpoints that fail to enforce access control checks before returning sensitive subscriber information. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis, but the CVSS:3.1 score of 7.5 with PR:N and AV:N reflects that the attack surface is fully accessible to unauthenticated internet-facing requests.
Denial of service in free5GC v4.1.0 allows remote unauthenticated attackers to crash the Access and Mobility Management Function (AMF) by sending a crafted PATCH request to the event subscription endpoint processed by ModifyAMFEventSubscriptionProcedure in processor/event_exposure.go. The root cause is CWE-770 - uncontrolled resource allocation - meaning the handler does not bound consumption triggered by attacker-supplied input. SSVC classifies this as automatable, making scripted mass exploitation feasible, though no active exploitation or public proof-of-concept code is confirmed at time of analysis.
Denial-of-service in free5gc v4.0.1 allows remote unauthenticated attackers to crash the 5G core network's AMF component by sending a specially crafted NAS PDU to the NGAP handler. The vulnerability stems from improper resource allocation (CWE-770) in the NGAP message processing path, which when triggered drops all active 5G sessions handled by that AMF instance. No public exploit code has been identified and CISA KEV confirms no active exploitation, but SSVC rates the attack as automatable, meaning it can be scripted without manual interaction.
NULL pointer dereference in the AMF NGAP Dispatcher of free5GC v4.0.1 allows an unauthenticated remote attacker to crash the Access and Mobility Management Function by sending crafted NGAP messages during the initialization of a new RAN connection, resulting in complete availability loss for the 5G core control plane. The AMF is a central 5G core component responsible for registration and mobility management for all connected user equipment, so a successful crash severs control-plane service for all gNBs attached to that AMF instance. No public exploit code has been confirmed and no CISA KEV listing exists at time of analysis, though SSVC rates the attack as Automatable given the no-authentication, low-complexity network exposure.
Denial of Service in Open5GS v2.7.6 targets the NUDM-UECM (Network Unified Data Management - UE Context Management) interface, where a crafted HTTP DELETE request triggers a reachable assertion failure that crashes the UDM process. The CVSS vector (AV:N/AC:L/PR:N/UI:N) and SSVC 'Automatable: yes' rating indicate this is trivially scriptable over the network. No active exploitation or public proof-of-concept code has been identified at time of analysis.
Denial of service in free5gc v4.1.0's CreateUEContext handler allows unauthenticated remote attackers to crash or exhaust the 5G core network service by sending crafted UE context creation requests. The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling) - the handler performs no rate limiting or resource bounding when processing incoming context requests. No active exploitation is confirmed (not in CISA KEV), though SSVC flags the attack as automatable, meaning a single host could sustain a disruptive flood without manual repetition.
Reachable assertion in Open5GS v2.7.6 SMF crashes the Session Management Function via a crafted DELETE request to the /nsmf-pdusession/v1/sm-contexts endpoint, enabling unauthenticated remote denial of service against the 5G core. Per CVSS PR:N, no authentication is required, though network access to the internal Service Based Interface (SBI) is a practical prerequisite in standard deployments. No active exploitation has been confirmed (not in CISA KEV), no public exploit code is known, and SSVC rates this as non-automatable with partial technical impact - suggesting real-world risk is lower than the 7.5 CVSS score implies.
Remote code execution via log path traversal in Flowintel 3.3.0 and later is achievable by an authenticated administrator who redirects the LOG_FILE configuration setting to an arbitrary filesystem path and injects server-side template syntax through attacker-controlled logged content. The upstream commit explicitly documents this multi-step exploitation chain - redirecting log output to a template file and triggering application rendering to execute injected code - making weaponization technically straightforward for any attacker holding admin credentials. No public exploit or CISA KEV listing is identified at time of analysis; upstream fix is available as a GitHub commit from the Flowintel maintainer CIRCL.
Path traversal in Spring Cloud Config Server's native environment repository allows unauthenticated remote attackers to read arbitrary files outside the configured search-locations directory on the server filesystem. Affected deployments span four release lines - 3.1.14 and earlier, 4.0.0-4.2.8, 4.3.0-4.3.4, and 5.0.0-5.0.4 - and are limited to the native filesystem backend mode. No public exploit code has been identified and CISA KEV does not list this vulnerability, though the centralized role of Config Server as a secrets store elevates real-world impact beyond the raw EPSS percentile.
Uncontrolled resource consumption in Spring Batch's FlatFileItemReader allows denial-of-service against batch jobs that process externally-supplied flat files containing multi-line records. When a specially crafted file is fed to the reader - exploiting its logic for assembling logical records spread across multiple physical lines (e.g., quoted CSV fields with embedded newlines) - the job stalls or exhausts memory, disrupting batch processing pipelines. Affected are all actively maintained Spring Batch branches: 4.3.0-4.3.13, 5.2.0-5.2.6, and 6.0.0-6.0.4. No public exploit or active exploitation has been identified at time of analysis.
Unauthenticated content exfiltration in Trilium up to 0.103.0 is possible through the public share-search endpoint, which applies authorization only to the ancestor note supplied in the request rather than to each result it returns. Any visitor with HTTP access to the instance can query `/share/api/notes` to enumerate titles, tree paths, and share identifiers of notes protected by `shareCredentials` passwords or hidden via `shareHiddenFromTree`, and can use the endpoint as a boolean substring oracle to iteratively reconstruct the full plaintext of password-gated notes. No public exploit has been identified at time of analysis, and the issue is patched in version 0.104.0.
Hardcoded Langfuse API credentials embedded in PentestGPT 1.0.0's core telemetry module expose all user session telemetry to unauthorized third parties. Any actor who reads the public GitHub repository can extract the literal API key pair from pentestgpt/core/langfuse.py:114 and authenticate directly to the Langfuse observability backend, gaining read access to pentest session traces that may contain targets, findings, and full AI prompt-response histories. No public exploit or CISA KEV listing exists, though the source reference functionally serves as exploit documentation; EPSS is 0.22% at the 12th percentile.
Price manipulation in the StoreGrowth WordPress plugin (versions before 2.1.2) enables unauthenticated attackers to add products to a WooCommerce cart at arbitrary, attacker-chosen prices that carry through to checkout totals - directly enabling financial fraud against affected merchants. The flaw exists across two unauthenticated AJAX actions that accept browser-supplied price values without any server-side validation, and is conditional on the BOGO (Buy One Get One) promotional feature being active. No public exploit code has been identified, and EPSS is low at 0.18% (8th percentile), though SSVC rates the attack as automatable - making mass scanning of vulnerable stores feasible.
Denial of Service in free5gc v4.0.1 allows unauthenticated remote attackers to crash the NSSF (Network Slice Selection Function) by sending a crafted POST request to the NssaiAvailabilitySubscriptionCreate endpoint. The affected component handles 5G network slice subscription lifecycle management, and resource exhaustion causes the NSSF to become unresponsive, disrupting slice selection for all connected 5G devices on that core instance. No active exploitation is confirmed (no CISA KEV listing) and EPSS is very low at 0.18% (8th percentile), indicating minimal real-world exploitation at time of analysis.
Remote unauthenticated denial-of-service in the NRF Discovery service of free5gc v4.0.1 can be triggered by sending crafted input to the complexQueryFilterSubprocess function, crashing the service without any authentication or user interaction. The NRF (Network Repository Function) is a critical 5G core component responsible for service discovery; its disruption can cascade to affect the entire 5G core network's ability to register and locate network functions. No public exploit has been identified and EPSS sits at 0.18% (8th percentile), suggesting low observed exploitation activity despite the high CVSS base score.
NULL pointer dereference in free5gc v4.0.1's CDR processing path enables unauthenticated remote attackers to crash the 5G core network service by sending a crafted payload, causing a complete denial of service against the affected network function. The CVSS 7.5 score reflects a straightforward, credential-free network attack path requiring no complexity; however, EPSS places real-world exploitation probability at 0.18% (8th percentile), indicating limited threat actor interest at time of analysis. No public exploit code and no CISA KEV listing have been identified.
Integer overflow in the open5gs 2.7.6 NRF (Network Repository Function) discovery endpoint enables remote unauthenticated denial of service. Sending a crafted HTTP/2 GET request to /nnrf-disc/v1/nf-instances triggers arithmetic overflow that crashes the NRF service, disrupting 5G network function discovery for all dependent core network components. No public exploit has been identified and EPSS at 0.18% (7th percentile) reflects low current exploitation interest, though the unauthenticated network vector lowers the bar for any attacker with access to the SBI interface.
Denial-of-service via segmentation fault in ccoap's option parsing logic allows unauthenticated remote attackers to crash any service built on the library by sending a single malformed CoAP message. The vulnerability exists at commit 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5 of the ipflavors/ccoap C library, where the option parser does not adequately validate that sufficient data is present before accessing option fields, triggering an out-of-bounds write (CWE-787). No public exploit code or CISA KEV listing is present, and EPSS probability is very low at 0.17%, though the trivial trigger condition - a single malformed UDP packet - makes opportunistic scanning straightforward against any exposed CoAP endpoint.
Null pointer dereference in ccoap (commit 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5) allows remote unauthenticated attackers to crash the CoAP server by submitting requests that trigger a race condition between the session dispatch and cleanup threads. The impact is confined to availability - the server process crashes, producing a denial-of-service condition with no confidentiality or integrity consequences. No active exploitation is confirmed (not in CISA KEV), and an EPSS score of 0.17% (7th percentile) places this in the lowest tier of current exploitation likelihood.
Denial of service in ccoap's option parsing logic allows unauthenticated remote attackers to crash any service built on commit 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5 by sending a single CoAP message carrying an invalid option number, triggering a segmentation fault. The impact is strictly availability - confidentiality and integrity are unaffected (CVSS C:N/I:N). No public exploit code and no CISA KEV listing have been identified; EPSS at 0.17% (7th percentile) reflects minimal current exploitation interest.
Integer overflow in Open5GS v2.7.6's Session Management Function (SMF) allows remote unauthenticated attackers to crash the service via a crafted GTP packet, causing Denial of Service against 5G core network infrastructure. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms zero-authentication network exploitation requiring no user interaction. Researcher-published proof-of-concept code exists in a public GitHub repository and gist, though no CISA KEV listing confirms active in-the-wild exploitation at time of analysis.
Spring for GraphQL's Spring Data pagination integration blindly forwards client-supplied Connection field arguments to the underlying repository without enforcing resource limits, enabling an unauthenticated remote attacker to exhaust JVM heap memory or impose sustained load on the backing datastore via crafted GraphQL pagination queries. Three release branches are affected: 2.0.0-2.0.4, 1.4.0-1.4.6, and 1.2.0-1.3.9, as confirmed by EUVD-2026-67178 and the VMware/Spring security advisory. No public exploit has been identified and the EPSS probability is very low (0.16%, 5th percentile), though the unauthenticated, network-accessible attack path makes any openly exposed endpoint a viable denial-of-service target.
Null pointer dereference in ccoap's CoAP server (commit 77f55c4b) allows unauthenticated remote attackers to crash the server process by sending a crafted CoAP message. The vulnerability exists in coap_server_handle_session(), which calls strncmp() on a URI_PATH option's data pointer without first validating that the pointer is non-NULL, triggering a segmentation fault on receipt of a malformed packet. With CVSS A:H and no authentication required (PR:N/AC:L), this is a straightforward remote denial-of-service; no public exploit or KEV listing has been identified at time of analysis.
Null pointer dereference in ccoap's coap_dump_msg() function causes remote denial of service when processing CoAP messages that carry options with zero-length values. The flaw is pinned to commit 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5 of the ipflavors/ccoap library. An unauthenticated remote attacker reachable by the CoAP service can crash any process that links this library by sending a single crafted packet. No public exploit has been identified at time of analysis, and EPSS is 0.15% (5th percentile), reflecting low real-world exploitation activity.
Heap-based buffer overflow in FFmpeg's libswscale library enables unauthenticated remote attackers to crash media-processing applications via a crafted input file. The vulnerable function ff_sws_alphablendaway, invoked during alpha channel compositing in git-master commit 722a217, mishandles attacker-controlled input and corrupts heap memory, producing a Denial of Service. No active exploitation is confirmed - EPSS stands at 0.15% (5th percentile) with no CISA KEV listing - indicating this is currently a crash risk rather than a weaponized threat.
Memory exhaustion in Spring Framework's RSocket server implementation allows unauthenticated remote attackers to crash or degrade affected applications by sending malformed SETUP frames that trigger unreclaimed heap allocations. All actively maintained Spring Framework branches are affected - 5.2.x through 7.0.x - with the condition that the application must explicitly expose an RSocket endpoint. No public exploit code has been identified at time of analysis, and CISA SSVC confirms no current exploitation activity, though the attack is classified as automatable.
Uncontrolled resource consumption in Spring Framework's SpEL evaluator allows unauthenticated remote attackers to trigger a Denial of Service by submitting expressions using the power operator (^) with BigDecimal or BigInteger operands and arbitrarily large exponents, causing unbounded CPU and memory exhaustion in the JVM. All maintained Spring Framework release lines from 5.2.x through 7.0.x are affected, covering a large portion of the enterprise Java ecosystem. No public exploit has been identified and exploitation probability is very low (EPSS 0.15%, 4th percentile), though SSVC flags the attack class as automatable.
Spring WebFlux's PartEventHttpMessageReader fails to enforce the configured maxPartSize limit when maxInMemorySize is explicitly set to -1, allowing remote unauthenticated attackers to upload multipart request parts of arbitrary size in violation of application-defined policy. Affected are Spring Framework 6.1.0 through 6.1.28, 6.2.0 through 6.2.19, and 7.0.0 through 7.0.8. No public exploit code has been identified at time of analysis and EPSS is very low at 0.15% (4th percentile), but the SSVC automatable flag means scanning and exploitation can be automated at scale against exposed endpoints.
Denial of Service exposure in Spring Framework's data binding infrastructure allows unauthenticated remote attackers to exhaust application resources by submitting crafted property path expressions to any endpoint that binds user-supplied paths onto Java target objects. Affected versions span the entire actively maintained Spring Framework lineage - 5.2.x through 7.0.x - making the aggregate exposure footprint very large. No public exploit is referenced and EPSS sits at 0.15% (4th percentile), indicating low current exploitation activity despite the high CVSS score of 7.5.
Integer overflow in FFmpeg's libswscale library allows any application or service processing attacker-controlled image files to be crashed via a specially crafted input, causing a Denial of Service. The vulnerable function hScale16To19_c() in output.c is affected in build N-122528-gdd2976b9e1; the CVSS vector (AV:N/AC:L/PR:N/UI:N) reflects worst-case exposure in automated media-processing services. Despite the high CVSS score of 7.5, the EPSS probability is just 0.15% at the 4th percentile and no active exploitation has been confirmed, indicating limited real-world exploitation activity at time of analysis.
Denial of service in free5gc v4.0.1's NAS decoder allows unauthenticated remote attackers to crash the AMF (Access and Mobility Management Function) by sending a crafted Registration Request message, disrupting 5G core network availability. The CVSS vector (AV:N/AC:L/PR:N/UI:N/A:H) confirms zero-prerequisite network exploitability - any host able to reach the N1 interface can trigger the fault. No public exploit or active exploitation has been identified at time of analysis; EPSS at 0.15% (4th percentile) reflects low observed exploitation probability, consistent with free5gc's predominantly research-oriented deployment footprint.
Integer overflow in FFmpeg's libswscale/utils.c component, present in development snapshot N-122528-gdd2976b9e1, allows unauthenticated remote attackers to crash any application relying on that component for image scaling by supplying a specially crafted image file. The CVSS 7.5 High rating reflects a network-reachable, zero-authentication denial-of-service path, but the EPSS score of 0.15% at the 4th percentile indicates negligible observed exploitation activity. No public exploit code and no CISA KEV listing are confirmed at time of analysis.
Integer overflow in FFmpeg's libswscale/output.c (yuv2planeX_8_c function) allows a remote attacker to crash the FFmpeg process by supplying a crafted video file, causing denial of service in any pipeline that processes untrusted media. The affected build is development snapshot N-122528-gdd2976b9e1; stable release exposure is unconfirmed. No public exploit code and no CISA KEV listing exist; EPSS of 0.15% (4th percentile) indicates very low near-term exploitation probability despite the high CVSS base score.
Denial of service in free5GC v4.0.1 affects the SUCI (Subscription Concealed Identifier) parsing routine invoked during 5G UE registration, allowing unauthenticated remote attackers to crash or resource-exhaust the core network by sending crafted SUCI payloads. With CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), any attacker reachable on the AMF's N1/NAS interface can trigger the flaw before any subscriber authentication occurs. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Resource exhaustion in the free5GC v4.0.1 NF Discovery endpoint allows unauthenticated remote attackers to crash or hang the Network Repository Function (NRF) by sending a crafted snssais query parameter, disrupting 5G core service discovery for all dependent network functions. The root cause is CWE-770 - missing input validation and resource throttling on a control-plane REST API that is central to 5G Service Based Architecture (SBA) operation. No public exploit code exists and EPSS sits at the 4th percentile, indicating low opportunistic exploitation likelihood; however, the absence of a confirmed patch makes this a persisting exposure for free5GC operators.
Denial of service in free5gc v4.0.1 allows unauthenticated remote attackers to crash the 5G core network processor by sending a crafted input to the buildFilter function in processor/processor.go. The flaw stems from improper input validation (CWE-20), meaning the function does not adequately sanitize or reject malformed data before processing it, causing an unrecoverable failure of the affected network function. No public exploit code or active exploitation has been identified; EPSS stands at 0.15% (4th percentile), indicating very low current exploitation probability.
Remote unauthenticated Denial of Service in free5gc v4.0.1 allows network-accessible attackers to crash the 5G core parameter provisioning service by sending a crafted input to the HandleUpdate function in /sbi/parameter_provision.go. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms no authentication or special preconditions are required, though the EPSS score of 0.15% at the 4th percentile and absence from CISA KEV indicate no public exploit code and no confirmed active exploitation at time of analysis.
NULL pointer dereference in free5gc v4.0.1's UDMC registration handler exposes remote unauthenticated attackers to crashing the 5G core network process by submitting a specially crafted registration payload, resulting in complete availability loss of the affected network function. Any deployment with a network-accessible UDMC registration interface running free5gc v4.0.1 is at risk. No public exploit has been identified at time of analysis; EPSS exploitation probability is very low at 0.15% (4th percentile), consistent with the niche, research-oriented deployment footprint of this product.
free5gc v4.0.1, an open-source Go-based 5G core network implementation, is vulnerable to denial-of-service via crafted input to the HandleGetSharedData function, which can exhaust system resources and crash core network functions. The CVSS score of 7.5 HIGH reflects a zero-authentication network vector, though the very low EPSS of 0.15% (4th percentile) and absence of KEV listing or public proof-of-concept indicate minimal observed exploitation risk at this time. Deployments are typically confined to research and lab environments, reducing broad exposure.
NULL pointer dereference in FFmpeg development snapshot N-122528-gdd2976b9e1 crashes the FFmpeg process when parsing a maliciously crafted video file via the get_min_buffer_size function in libswscale/slice.c. Any application or automated pipeline using this FFmpeg build to process untrusted video input is exposed to unauthenticated remote denial of service, as confirmed by the AV:N/AC:L/PR:N/UI:N CVSS vector. No public exploit code exists at time of analysis, and EPSS at 0.15% (4th percentile) signals low current threat-actor activity.
Integer overflow in FFmpeg's libswscale image-scaling library (output.c) enables Denial of Service against any service or application that processes attacker-supplied media through the swscale API. The flaw, confirmed in snapshot build N-122528-gdd2976b9e1, resides in the target_sws_fuzzer() harness and indicates that the underlying scaling output path contains an integer wraparound reachable via crafted input. No active exploitation is confirmed (not in CISA KEV), no public exploit code has been identified, and EPSS probability is negligible at 0.15%, suggesting minimal current threat actor interest.
Denial of Service in free5gc v4.0.1 allows remote unauthenticated attackers to crash or disrupt the 5G core network by sending crafted input to the RechargePut function. The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling), meaning the function fails to bound resource consumption when processing malformed payloads. No public exploit exists at time of analysis, and an EPSS score of 0.15% (4th percentile) reflects minimal real-world exploitation pressure despite the network-accessible, no-authentication attack vector.
Denial of service in free5gc v4.1.0 allows unauthenticated remote attackers to crash the UE context management service by sending a crafted HTTP PUT request to the /v1/ue-contexts/{supi} REST API endpoint, invoking the CreateUEContextProcedure function. The root cause is CWE-770 - uncontrolled resource allocation - where a malformed request triggers unchecked resource consumption that terminates the AMF process. No public exploit code has been identified and the EPSS score is 0.15% (4th percentile), though the zero-prerequisite network vector makes any exposed deployment immediately actionable.
Denial of service in free5gc v4.0.1 is exploitable via the HTTPModifySubscription handler, which fails to reject crafted HTTP input before processing, causing the affected 5G core network function to crash. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms remote, unauthenticated exploitation with no user interaction required, making any network-reachable deployment of the SBI interface a viable target. No public exploit code has been identified and EPSS sits at just 0.15% (4th percentile), indicating low observed attacker interest at time of analysis.