A nil pointer dereference in free5GC SMF leads to a crash when it processes a malformed PFCP SessionReportRequest that omits the mandatory URRID sub-IE while ReportType.USAR equals 1. The crash terminates the SMF process, causing a loss of session management services. Because the crash occurs without requiring code execution, the primary impact is service disruption, not data compromise.

The vulnerability affects the free5GC SMF component of the free5GC open‑source 5G core network. Versions up to and including 1.4.1 are impacted. All deployments of SMF that accept PFCP messages on UDP port 8805 are potentially susceptible unless mitigations are applied.

The CVSS score of 6.6 indicates a moderate severity, and the EPSS score of less than 1% suggests a low probability of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker can trigger the crash by sending a crafted PFCP SessionReportRequest from a remote host that the SMF accepts. Therefore, the primary attack surface is remote network traffic to PFCP. While there are no documented exploits, the low EPSS score reflects that the exploit window is narrow, but the impact to availability makes it a concern for high‑availability deployments.