CVE-2026-1975 Free5GC pfcp_reports.go identityTriggerType null pointer dereference
Remote attackers can cause a denial of service in Free5GC via a null pointer dereference in PFCP report handling.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-1975?
CVE-2026-1975 is a medium-severity vulnerability in Free5gc Free5gc, published on 6 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A security flaw has been discovered in Free5GC up to 4.1.0. This impacts the function identityTriggerType of the file pfcp_reports.go. The manipulation results in null pointer dereference. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. Applying a patch is advised to resolve this issue.
Which versions are affected by CVE-2026-1975?
It affects 1 product.
Products include Free5gc Free5gc.
How do I fix CVE-2026-1975?
No fix has been published for CVE-2026-1975 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-1975 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-1975 exists.
Other vulnerabilities in Free5gc Free5gc
- CVE-2026-44327 free5GC: NEF nnef-oam route group is unauthenticated; no-token requests reach the OAM handler
- CVE-2026-44329 free5GC's SMF UPI management interface lacks auth middleware; unauthenticated topology read/write requests reach handlers
- CVE-2026-44330 free5GC's NEF nnef-pfdmanagement API is unauthenticated; forged bearer tokens can read PFD data and create/delete PFD subscriptions
- CVE-2025-63679 Memory corruption in n/a
- CVE-2026-44315 free5GC's NEF 3gpp-pfd-management API is unauthenticated; forged bearer tokens can create, read, and delete PFD transactions
Sources
Also known as GHSA-jfhf-hgcv-5v98.