PT-2026-21565 · Free5Gc · Free5Gc

Published 2026-02-23 · Updated 2026-02-28 · CVE-2025-69248

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions free5GC versions up to and including 1.4.1

Description free5GC is an open-source project for 5th generation (5G) mobile core networks. A buffer overflow exists in the AMF service, potentially leading to a denial of service. Remote, unauthenticated attackers can exploit this by sending a specially crafted NAS Registration Request containing a malformed 5GS Mobile Identity. This can cause the AMF service to crash, resulting in a complete denial of service for the 5G core network. All deployments of free5GC utilizing the AMF component may be affected. The vulnerability occurs due to improper handling of the 5GS Mobile Identity within the NAS Registration Request.

Recommendations Apply the official patch available in pull request 43 of the free5gc/nas repository.

Exploit

Fix

DoS

Improper Validation of Array Index

Weakness Enumeration

CWE-129

Related Identifiers

CVE-2025-69248

GHSA-H6XC-8VVF-JCJP

Affected Products

Free5Gc

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/69xxx/CVE-2025-69248.json · Exploit
• https://github.com/free5gc/free5gc/security/advisories/GHSA-h6xc-8vvf-jcjp · Vendor Advisory
• https://github.com/free5gc/free5gc/issues/747 · Vendor Advisory
• https://github.com/free5gc/nas/commit/0329a7ac3f314f210366c1b3c33dc29eded4ac5f · Patch
• https://github.com/free5gc/nas/pull/43 · Patch
• https://osv.dev/vulnerability/CVE-2025-69248 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-69248 · Security Note
• https://twitter.com/cracbot/status/2027700415240999186 · Twitter Post
• https://t.me/cveNotify/152941 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2026118011455754273 · Twitter Post
• https://twitter.com/cracbot/status/2027338115430678792 · Twitter Post
• https://twitter.com/transilienceai/status/2026137970906910950 · Twitter Post
• https://twitter.com/CVEnew/status/2026184680408854674 · Twitter Post
• https://t.me/cveNotify/153183 · Telegram Post
• https://t.me/CVEtracker/45526 · Telegram Post