PT-2026-6668 · Free5Gc · Free5Gc

Linziyu · Published 2026-02-06 · Updated 2026-02-06 · CVE-2026-1975

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Free5GC versions prior to 4.1.1

Description A security flaw exists in Free5GC up to version 4.1.0. The issue resides in the identityTriggerType function within the pfcp reports.go file, leading to a null pointer dereference. This can be exploited remotely. The exploit has been publicly released and may be used in attacks.

Recommendations Versions prior to 4.1.1 should be updated.

Exploit

Fix

Improper Resource Release

NULL Pointer Dereference

Weakness Enumeration

CWE-404

CWE-476

Related Identifiers

CVE-2026-1975

Affected Products

Free5Gc

References · 13

• 🔥 https://github.com/free5gc/free5gc/issues/814#issue-3831993593 · Exploit
• 🔥 https://vuldb.com/?submit.743238 · Exploit
• https://github.com/free5gc/free5gc/issues/814 · Vendor Advisory
• https://github.com/free5gc/smf/pull/189 · Patch
• https://osv.dev/vulnerability/CVE-2026-1975 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-1975 · Security Note
• https://t.me/cveNotify/151081 · Telegram Post
• https://vuldb.com/?id.344497 · Note
• https://twitter.com/VulmonFeeds/status/2019669612984475674 · Twitter Post
• https://twitter.com/CVEnew/status/2019618721741041866 · Twitter Post
• https://github.com/free5gc/free5gc · Note
• https://t.me/CVEtracker/43885 · Telegram Post
• https://vuldb.com/?ctiid.344497 · Note