The vulnerability resides in the HandleReports function within the PFCP UDP Endpoint of Free5GC SMF. A malformed PFCP report, when processed, can cause the SMF to crash or become unresponsive, resulting in a denial of service. The weakness is a faulty handling of PFCP messages and is classified as CWE-404. Consequently, an attacker can interrupt normal SMF operations and deny service to users relying on the network.

This flaw affects Free5GC SMF versions up to 4.1.0. The issue is confined to the Free5GC SMF component, which implements the PFCP protocol over UDP. Administrators should verify that their deployed SMF does not run a version earlier than 4.1.1 and that the build is sourced from the official Free5GC repository.

The CVSS v3 score of 6.9 indicates a medium severity that can affect availability. Although the EPSS score is below 1 %, suggesting a low overall exploitation probability, the vulnerability is remotely exploitable via crafted PFCP UDP packets, removing the need for local access or privileged credentials. The flaw is not listed in CISA’s KEV catalog, implying no widespread known exploits at present. Nevertheless, the remote nature and potential for service disruption warrant immediate attention, especially in production 5G core networks that rely on Free5GC SMF.