A null pointer dereference occurs in the function HandleCreateSmPolicyRequest within the Free5GC pcf component. The flaw allows an attacker to send a specially crafted request that causes the service to dereference a null pointer, terminating the process. Because the crash disrupts the policy management functionality, an attacker can cause a denial of service. The vulnerability exemplifies weaknesses identified by CWE-476 and CWE-404.

The affected vendor is Free5GC, specifically the pcf component of the 5G core network. Versions up to and including 1.4.1 are vulnerable; the fix is contained in commit df535f5524314620715e842baf9723efbeb481a7. Exact version numbers beyond 1.4.1 are not listed, so any earlier or equal releases are considered affected until an update is applied.

The CVSS score of 6.9 indicates moderate severity, while the EPSS score is less than 1%, suggesting that exploitation is unlikely under normal circumstances. The vulnerability is not present in the CISA KEV catalog. Attackers can reach the flaw remotely by targeting the smpolicy service endpoints. A successful exploit would drop the policy management process, leading to a service outage for the 5G core.