A null pointer dereference flaw exists in the SessionDeletionResponse function of the SMF component of Free5GC up to version 4.1.0. When an attacker sends a crafted message that triggers this code path, the SMF process can crash, potentially allowing a denial of service. The failure does not explicitly grant remote code execution or data exfiltration, but it does disrupt service availability for affected users.

The vulnerability affects all Free5GC deployments running SMF version 4.1.0 or earlier. The affected component is the SMF (Session Management Function) of the Free5GC network function suite.

The CVSS score of 6.9 indicates a moderate severity vulnerability. The EPSS score of less than 1% suggests a low but non-zero likelihood of exploitation, yet public exploits are known to exist. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, but its remote nature and public exploit reduces confidence in the risk assessment. An attacker with network visibility to the SMF can trigger the flaw and cause an outage.