Description
A vulnerability was determined in Free5GC up to 4.1.0. The impacted element is the function establishPfcpSession of the component SMF. Executing a manipulation can lead to null pointer dereference. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. It is best practice to apply a patch to resolve this issue.
Published: 2026-02-06
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Apply Patch
AI Analysis

Impact

Free5GC versions up to 4.1.0 contain a null pointer dereference in the establishPfcpSession function of the SMF component. When this function receives a crafted request, it dereferences a null pointer, causing the SMF process to crash. This vulnerability leads to a denial‑of‑service condition and may allow an attacker to disrupt 5G core network services. The weakness corresponds to CWE‑404 (Improper Resource Shutdown or Release) and CWE‑476 (NULL Pointer Dereference).

Affected Systems

The affected product is Free5GC, the open‑source 5G core implementation. All releases up through version 4.1.0 are impacted; later releases contain the patched code.

Risk and Exploitability

The CVSS base score of 6.9 indicates moderate to high severity. The EPSS score is less than 1 %, suggesting a low likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the attack vector is remote, and the exploit is publicly disclosed. An attacker can trigger the crash by sending a specially crafted SMF request over the network. As the flaw is not authenticated, any host able to reach the SMF control plane is a potential target.

Generated by OpenCVE AI on April 17, 2026 at 22:57 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to a Free5GC release newer than 4.1.0, which contains the patch for establishPfcpSession.
  • Restrict network access to the SMF control‑plane interfaces to trusted entities and enforce authentication checks before processing PFCP sessions.
  • Enable logging for SMF failures and monitor for repeated crash events, alerting administrators to potential exploitation attempts.

Generated by OpenCVE AI on April 17, 2026 at 22:57 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 09 Feb 2026 16:00:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:free5gc:free5gc:*:*:*:*:*:*:*:*

Fri, 06 Feb 2026 20:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 06 Feb 2026 12:15:00 +0000

Type Values Removed Values Added
First Time appeared Free5gc
Free5gc free5gc
Vendors & Products Free5gc
Free5gc free5gc

Fri, 06 Feb 2026 02:15:00 +0000

Type Values Removed Values Added
Description A vulnerability was determined in Free5GC up to 4.1.0. The impacted element is the function establishPfcpSession of the component SMF. Executing a manipulation can lead to null pointer dereference. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. It is best practice to apply a patch to resolve this issue.
Title Free5GC SMF establishPfcpSession null pointer dereference
Weaknesses CWE-404
CWE-476
References
Metrics cvssV2_0

{'score': 5, 'vector': 'AV:N/AC:L/Au:N/C:N/I:N/A:P/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 5.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Free5gc Free5gc
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-02-23T09:19:46.366Z

Reserved: 2026-02-05T13:33:39.834Z

Link: CVE-2026-1973

cve-icon Vulnrichment

Updated: 2026-02-06T19:31:59.085Z

cve-icon NVD

Status : Analyzed

Published: 2026-02-06T02:16:05.620

Modified: 2026-02-09T15:48:21.187

Link: CVE-2026-1973

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-17T23:00:12Z

Weaknesses