Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-1975: Free5GC allows remote crash via crafted PFCP report

CVE-2026-1975 · published 9 months ago

Summary

The Free5GC software version up to 4.1.0 can be forced to stop working when it receives a specially crafted network message. An attacker from outside the network can trigger this, potentially disrupting service. Install the latest update that fixes the problem as soon as possible.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
free5gc	free5gc	<= 4.1.0 `cpe:2.3:a:free5gc:free5gc::::::::`

Original advisory text

Free5GC pfcp_reports.go identityTriggerType null pointer dereference

A security flaw has been discovered in Free5GC up to 4.1.0. This impacts the function identityTriggerType of the file pfcp_reports.go. The manipulation results in null pointer dereference. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. Applying a patch is advised to resolve this issue.

References

https://github.com/free5gc/free5gc/ URL
https://vuldb.com/?id.344497 Vendor Advisory
https://github.com/free5gc/free5gc/issues/814 Third Party Advisory
https://github.com/free5gc/free5gc/issues/814#issue-3831993593 Third Party Advisory
https://vuldb.com/?ctiid.344497 Third Party Advisory
https://github.com/free5gc/smf/pull/189 Patch
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/1xxx/CVE-2026-1975.j... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-1975 Vendor Advisory
https://vuldb.com/?submit.743238 Vendor Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker partial control

Severity

7.8 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-404Improper Resource Shutdown or Release

CWE-476NULL Pointer Dereference

Timeline

Published6 Feb 2026

Updated4 Nov 2026

First seen6 Mar 2026

Sources

CVE-2026-1975 · NVD

CVE-2026-1975 · OSV

Track software like this

Free during beta