PT-2026-21588 · Free5Gc · Free5Gc Smf

Linziyuu · CVE-2026-25501 · Publicado 2026-02-24 · Atualizado 2026-03-01

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions free5GC SMF versions prior to 1.4.2

Description The free5GC Session Management Function (SMF), a component of the free5GC 5G mobile core network, is susceptible to a panic and process termination. This occurs due to a nil pointer dereference triggered by a malformed PFCP SessionReportRequest received on the SMF PFCP interface (UDP/8805). The issue affects versions up to and including 1.4.1.

Recommendations Apply access control lists (ACLs) or firewall rules to the PFCP interface to restrict access to trusted UPF IP addresses. Implement inspection or filtering of malformed PFCP SessionReportRequest messages at the network edge. Add recover() around PFCP handler dispatch to prevent complete process termination as a mitigation measure.

Exploit

Correção

NULL Pointer Dereference

Enumeração de Fraquezas

CWE-476

Identificadores relacionados

CVE-2026-25501

GHSA-VQ85-8F6P-G9Q5

Produtos afetados

Free5Gc Smf

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25501.json · Exploit
• https://github.com/free5gc/free5gc/issues/805 · Aviso do Fabricante
• https://github.com/free5gc/free5gc/security/advisories/GHSA-vq85-8f6p-g9q5 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-25501 · Nota de Segurança
• https://twitter.com/cracbot/status/2027700434346139683 · Publicação no Twitter
• https://twitter.com/cracbot/status/2027338134393115100 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2026184664076206186 · Publicação no Twitter
• https://twitter.com/cracbot/status/2028062747251130482 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-25501 · Aviso do Fabricante