VulnerabilityAnalyzed
CVE-2026-1739
A vulnerability has been found in Free5GC pcf up to 1.4.1.
MEDIUM 5.5EPSS 0.72%
Does this matter?
Lower severity and a low EPSS score (0.72%). Track it; it rarely justifies an emergency change on its own.
Description
A vulnerability has been found in Free5GC pcf up to 1.4.1. This affects the function HandleCreateSmPolicyRequest of the file internal/sbi/processor/smpolicy.go. The manipulation leads to null pointer dereference. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is df535f5524314620715e842baf9723efbeb481a7. Applying a patch is the recommended action to fix this issue.
- CVSS 4.0
- 5.5 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.72% probability · 52th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-404, CWE-476
- Affected
- free5gc/pcf
- Source
- cna@vuldb.com
References
- https://github.com/free5gc/free5gc/issues/803Exploit, Issue Tracking, Third Party Advisory
- https://github.com/free5gc/free5gc/issues/803#issue-3815770007Exploit, Issue Tracking, Third Party Advisory
- https://github.com/free5gc/pcf/Product
- https://github.com/free5gc/pcf/commit/df535f5524314620715e842baf9723efbeb481a7Patch
- https://github.com/free5gc/pcf/pull/62Issue Tracking
- https://vuldb.com/?ctiid.343638Permissions Required, VDB Entry
- https://vuldb.com/?id.343638Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.741194Third Party Advisory, VDB Entry
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.