CVE-2025-69252 free5GC has Null Pointer Dereference in UDM, Leading to Service Panic

What is CVE-2025-69252?

CVE-2025-69252 is a medium-severity vulnerability in free5gc udm, published on 23 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

free5gc UDM provides Unified Data Management (UDM) for free5GC, an open-source project for 5th generation (5G) mobile core networks. Versions up to and including 1.4.1 have a NULL Pointer Dereference vulnerability. Remote unauthenticated attackers can trigger a service panic (Denial of Service) by sending a crafted PUT request with an unexpected ueId, crashing the UDM service. All deployments of free5GC using the UDM component may be affected. free5gc/udm pull request 76 contains a fix for the issue. No direct workaround is available at the application level. Applying the official patch is recommended.

Weakness: CWE-476

Which versions are affected by CVE-2025-69252?

It affects 1 product.

Products include Free5gc Udm.

How do I fix CVE-2025-69252?

No fix has been published for CVE-2025-69252 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-69252 being exploited?

There is no known exploitation of CVE-2025-69252 in the wild and no public exploit code.

Other vulnerabilities in free5gc udm

• CVE-2026-33064 free5GC UDM DataChangeNotification Procedure Panic Due to Nil Pointer Dereference High 8.7
• CVE-2026-33191 free5GC UDM vulnerable to null byte injection in URL path parameters causing 500 Internal Server Error High 8.7
• CVE-2026-33192 free5GC UDM incorrectly returns 500 for empty supi path parameter in PATCH sdm-subscriptions reques High 8.7
• CVE-2023-46324 free5GC udm vulnerable to Invalid Curve Attack High 7.5
• CVE-2026-33065 free5GC UDM incorrectly returns 500 for empty supi path parameter in DELETE sdm-subscriptions request Medium 6.9

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-v8cv-qvf6-9rpm.