CVE-2025-65562: free5gc Improper Validation of Array Index

Vulnerability summary

CVE-2025-65562 is a high (CVSS 7.5) Improper Validation of Array Index vulnerability in free5gc. EPSS estimates a 0.56% chance of exploitation in the next 30 days, higher than 45.6% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 18-12-2025
   PublishedVulnerability first disclosed.
2. 19-12-2025
   Last modifiedVulnerability information updated.

Description

The free5GC UPF suffers from a lack of bounds checking on the SEID when processing PFCP Session Deletion Requests. An unauthenticated remote attacker can send a request with a very large SEID (e.g., 0xFFFFFFFFFFFFFFFF) that causes an integer conversion/underflow in LocalNode.DeleteSess() / LocalNode.Sess() when a uint64 SEID is converted to int and used in index arithmetic. This leads to a negative index into n.sess and a Go runtime panic, resulting in a denial of service (UPF crash). The issue has been reproduced on free5GC v4.1.0 with crashes observed in the session lookup/deletion path in internal/pfcp/node.go; other versions may also be affected. No authentication is required.

• CWE-129Improper Validation of Array IndexThe product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.