CVE-2026-1682: Free5GC SMF PFCP UDP Endpoint handler.go HandlePfcpAssociationReleaseRequest null pointer dereference

Vulnerability summary

CVE-2026-1682 is a high (CVSS 7.5) Improper Resource Shutdown or Release vulnerability in free5gc. EPSS estimates a 0.75% chance of exploitation in the next 30 days, higher than 54.4% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 30-01-2026
   PublishedVulnerability first disclosed.
2. 23-02-2026
   Last modifiedVulnerability information updated.

Description

A flaw has been found in Free5GC SMF up to 4.1.0. Affected is the function HandlePfcpAssociationReleaseRequest of the file internal/pfcp/handler/handler.go of the component PFCP UDP Endpoint. Executing a manipulation can lead to null pointer dereference. The attack may be launched remotely. The exploit has been published and may be used. A patch should be applied to remediate this issue.

• CWE-404Improper Resource Shutdown or ReleaseThe product does not release or incorrectly releases a resource before it is made available for re-use.
• CWE-476NULL Pointer DereferenceThe product dereferences a pointer that it expects to be valid but is NULL.