PT-2026-21588 · Free5Gc · Free5Gc Smf

Linziyuu · Published 2026-02-24 · Updated 2026-03-01 · CVE-2026-25501

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions free5GC SMF versions prior to 1.4.2

Description The free5GC Session Management Function (SMF), a component of the free5GC 5G mobile core network, is susceptible to a panic and process termination. This occurs due to a nil pointer dereference triggered by a malformed PFCP SessionReportRequest received on the SMF PFCP interface (UDP/8805). The issue affects versions up to and including 1.4.1.

Recommendations Apply access control lists (ACLs) or firewall rules to the PFCP interface to restrict access to trusted UPF IP addresses. Implement inspection or filtering of malformed PFCP SessionReportRequest messages at the network edge. Add recover() around PFCP handler dispatch to prevent complete process termination as a mitigation measure.

Exploit

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2026-25501

GHSA-VQ85-8F6P-G9Q5

Affected Products

Free5Gc Smf

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25501.json · Exploit
• https://github.com/free5gc/free5gc/issues/805 · Vendor Advisory
• https://github.com/free5gc/free5gc/security/advisories/GHSA-vq85-8f6p-g9q5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25501 · Security Note
• https://osv.dev/vulnerability/CVE-2026-25501 · Vendor Advisory
• https://twitter.com/cracbot/status/2027700434346139683 · Twitter Post
• https://twitter.com/cracbot/status/2027338134393115100 · Twitter Post
• https://twitter.com/CVEnew/status/2026184664076206186 · Twitter Post
• https://twitter.com/cracbot/status/2028062747251130482 · Twitter Post