CVE-2026-1973 Free5GC SMF establishPfcpSession null pointer dereference
Remote attackers can cause a denial of service in Free5GC SMF via a null pointer dereference in establishPfcpSession.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-1973?
CVE-2026-1973 is a medium-severity vulnerability in Free5gc Free5gc, published on 6 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability was determined in Free5GC up to 4.1.0. The impacted element is the function establishPfcpSession of the component SMF. Executing a manipulation can lead to null pointer dereference. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. It is best practice to apply a patch to resolve this issue.
Which versions are affected by CVE-2026-1973?
It affects 1 product.
Products include Free5gc Free5gc.
How do I fix CVE-2026-1973?
No fix has been published for CVE-2026-1973 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-1973 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-1973 exists.
Other vulnerabilities in Free5gc Free5gc
- CVE-2026-44327 free5GC: NEF nnef-oam route group is unauthenticated; no-token requests reach the OAM handler
- CVE-2026-44329 free5GC's SMF UPI management interface lacks auth middleware; unauthenticated topology read/write requests reach handlers
- CVE-2026-44330 free5GC's NEF nnef-pfdmanagement API is unauthenticated; forged bearer tokens can read PFD data and create/delete PFD subscriptions
- CVE-2025-63679 Memory corruption in n/a
- CVE-2026-44315 free5GC's NEF 3gpp-pfd-management API is unauthenticated; forged bearer tokens can create, read, and delete PFD transactions
Sources
Also known as GHSA-3gmf-2m92-wrxq.