The vulnerability arises from an improper null check in the GetSupiFromSuciSupiMap function of the AUSF UE authentication service. When the function attempts an interface conversion on a nil value, the service panics with "interface conversion: interface {} is nil, not *context.SuciSupiMap". This panic terminates the AUF service, causing a denial of service for all authentication requests that hit the /nausf-auth/v1/ue-authentications endpoint.

Affected deployments are all free5GC core networks running AUSF versions earlier than 1.4.2, including the long‑term support release free5GC v4.0.1. The vulnerability resides in the AUSF component of the free5GC suite and impacts the UE authentication service. Upgrading to AUSF 1.4.2 or later resolves the issue.

The CVSS score of 8.7 indicates high severity, although the EPSS score of less than 1% suggests the likelihood of exploitation is low at present. The vulnerability is not listed in CISA's KEV catalog. An attacker can trigger the crash by sending a crafted UE authentication request from a remote source, implying a network‑based attack vector. Mitigation requires applying the vendor patch or otherwise blocking external access to the AUSF authentication API.