CVE-2026-1976: Free5GC SMF SessionDeletionResponse null pointer dereference

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-02-06 · updated 2026-06-17
Weakness: CWE-404

Description

A weakness has been identified in Free5GC up to 4.1.0. Affected is the function SessionDeletionResponse of the component SMF. This manipulation causes null pointer dereference. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. It is suggested to install a patch to address this issue.

Affected products

free5gc: through 4.1.0

References

https://github.com/free5gc/free5gc/
https://github.com/free5gc/free5gc/issues/817
https://github.com/free5gc/free5gc/issues/817#issue-3832188092
https://github.com/free5gc/smf/pull/189
https://vuldb.com/?ctiid.344498
https://vuldb.com/?id.344498
https://vuldb.com/?submit.743239

Get alerted when CVE-2026-1976 or the next vulnerability affects your stack