A nil pointer dereference in the free5GC SMF causes a panic and process termination when a malformed PFCP SessionReportRequest is processed; the fault occurs when ReportType.USAR equals one and a mandatory URRID sub‑information element is omitted. Because the panic crashes the SMF process, a single crafted request can bring down the entire session management function, leading to denial of service of the 5G core network spokes it supports.

The vulnerability affects the free5GC Session Management Function (SMF), versions up to and including 1.4.1, deployed by operators using the open‑source free5GC 5G core stack.

The CVSS base score is 6.6, reflecting moderate severity. The EPSS score is less than 1 %, indicating a low probability of exploitation in the wild, and the issue is not listed in CISA’s KEV catalog. The flaw is reachable remotely via the PFCP UDP interface on port 8805, so an attacker with network access to the SMF endpoint can send the malformed SessionReportRequest and trigger a crash.