← Back

CVE-2026-1975

nvd nist
Published: Feb 6, 2026Modified: Feb 9, 2026

JSON object

Loading...
5.5
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Show more
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less
Source: CNA (Secondary)

Description

A security flaw has been discovered in Free5GC up to 4.1.0. This impacts the function identityTriggerType of the file pfcp_reports.go. The manipulation results in null pointer dereference. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. Applying a patch is advised to resolve this issue.

Affected (1)

Products: Free5gc: Free5gc
Free5gc
1 product
Free5gc
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Free5gc
Up to 4.1.0

Related CWEs

CWE-404
Improper Resource Shutdown or Release
The product does not release or incorrectly releases a resource before it is made available for re-use.
CWE-476
NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.

References (7)

Source: cna@vuldb.com
Product
Source: cna@vuldb.com
ExploitIssue TrackingVendor Advisory
Source: cna@vuldb.com
ExploitIssue TrackingVendor Advisory
Source: cna@vuldb.com
Issue Tracking
Source: cna@vuldb.com
Permissions RequiredVDB Entry
Source: cna@vuldb.com
Third Party AdvisoryVDB Entry
Source: cna@vuldb.com
ExploitThird Party AdvisoryVDB Entry

Timeline (23)

2/9/2026
10 changes
Initial Analysis - Reference Type
03:15 PM
- -
+ VulDB: https://vuldb.com/?submit.743238 Types: Exploit, Third Party Advisory, VDB Entry
Initial Analysis - Reference Type
03:15 PM
- -
+ VulDB: https://vuldb.com/?id.344497 Types: Third Party Advisory, VDB Entry
Initial Analysis - Reference Type
03:15 PM
- -
+ VulDB: https://vuldb.com/?ctiid.344497 Types: Permissions Required, VDB Entry
Initial Analysis - Reference Type
03:15 PM
- -
+ VulDB: https://github.com/free5gc/smf/pull/189 Types: Issue Tracking
Initial Analysis - Reference Type
03:15 PM
- -
+ VulDB: https://github.com/free5gc/free5gc/issues/814#issue-3831993593 Types: Exploit, Issue Tracking, Vendor Advisory
Initial Analysis - Reference Type
03:15 PM
- -
+ VulDB: https://github.com/free5gc/free5gc/issues/814 Types: Exploit, Issue Tracking, Vendor Advisory
Initial Analysis - Reference Type
03:15 PM
- -
+ VulDB: https://github.com/free5gc/free5gc/ Types: Product
Initial Analysis - CPE Configuration
03:15 PM
- -
+ OR *cpe:2.3:a:free5gc:free5gc:*:*:*:*:*:*:*:* versions up to (including) 4.1.0
Initial Analysis - CWE
03:15 PM
- -
+ CWE-476
Initial Analysis - CVSS V3.1
03:15 PM
- -
+ AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
2/6/2026
13 changes
New CVE Received - Reference
03:15 AM
- -
+ https://vuldb.com/?submit.743238
New CVE Received - Reference
03:15 AM
- -
+ https://vuldb.com/?id.344497
New CVE Received - Reference
03:15 AM
- -
+ https://vuldb.com/?ctiid.344497
New CVE Received - Reference
03:15 AM
- -
+ https://github.com/free5gc/smf/pull/189
New CVE Received - Reference
03:15 AM
- -
+ https://github.com/free5gc/free5gc/issues/814#issue-3831993593
New CVE Received - Reference
03:15 AM
- -
+ https://github.com/free5gc/free5gc/issues/814
New CVE Received - Reference
03:15 AM
- -
+ https://github.com/free5gc/free5gc/
New CVE Received - CWE
03:15 AM
- -
+ CWE-404
New CVE Received - CWE
03:15 AM
- -
+ CWE-476
New CVE Received - CVSS V2
03:15 AM
- -
+ (AV:N/AC:L/Au:N/C:N/I:N/A:P)
New CVE Received - CVSS V3.1
03:15 AM
- -
+ AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
New CVE Received - CVSS V4.0
03:15 AM
- -
+ AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
New CVE Received - Description
03:15 AM
- -
+ A security flaw has been discovered in Free5GC up to 4.1.0. This impacts the function identityTriggerType of the file pfcp_reports.go. The manipulation results in null pointer dereference. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. Applying a patch is advised to resolve this issue.