Free5GC SMF contains a null pointer dereference in the HandlePfcpAssociationReleaseRequest function of its PFCP UDP Endpoint. When the SMF processes a malformed PFCP Association Release Request, the handler dereferences a nil pointer, causing the SMF process to crash. This crash results in a denial of service for the affected SMF, disrupting routing and control functions in the 5G core. The vulnerability is identified as CWE‑476 (Null Pointer Dereference) and does not allow arbitrary code execution. The description states that the attack may be launched remotely, implying a crafted PFCP message is needed; this is inferred from the wording that a manipulation can lead to the dereference. Risk is further defined by a CVSS score of 6.9, indicating medium severity, and an EPSS of <1%, suggesting exploitation is currently unlikely although an exploit has already been published. The vulnerability is not listed in the CISA KEV catalog, so no immediate alerts are issued. However, because the flaw can be triggered by a single crafted PFCP Association Release Request over UDP, the attack remains possible until a patch is applied.

Free5GC SMF component versions up to 4.1.0 are affected. The flaw resides in the internal/pfcp/handler/handler.go file within the PFCP UDP Endpoint of the SMF. Users running the open‑source 5G core stack should verify that their SMF deployment is newer than 4.1.0 to avoid the vulnerability.

The medium CVSS score reflects the potential for a denial of service but not for arbitrary code execution. With an EPSS of <1%, current exploitation rates are low, yet the existence of a publicly released exploit raises concern. The vulnerability is not present in CISA KEV, indicating no current active advisories. The flaw can be triggered remotely by an attacker sending a crafted PFCP Association Release Request, which is inferred to be the required input to trigger the null pointer dereference, but no further privileges are gained. Until a patch is applied, the SMF remains exposed to potential crashes from malicious PFCP traffic.