← Vulnerability feed

Vulnerability record · CVE-2026-33064 · published 20 March 2026

CVE-2026-33064: Free5gc udm null pointer dereference vulnerability

Free5gc · Udm

Free5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core networks. Versions prior to 1.4.2 are vulnerable to procedure panic caused by Nil Pointer Dereference in the /sdm-subscriptions endpoint. A remote attacker can cause the UDM service to panic and crash by sending a crafted POST request to the /sdm-subscriptions endpoint with a malformed URL path containing path traversal sequences (../) and a large JSON payload. The DataChangeNotificationProcedure function in notifier.go attempts to access a nil pointer without proper validation, causing a complete service crash with "runtime error: invalid memory address or nil pointer dereference". Exploitation would result in UDM functionality disruption until recovery by restart. This issue has been fixed in version 1.4.2.

8.7 CVSS 4.0 High EPSS 0.78% · top 45.9% CWE-478 · CWE-478CWE-476 · NULL pointer dereference
8.7CVSS 4.0 base score
0.78%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References, 1 tagged exploit
17 Jun 2026Last modified by NVD

Description

Free5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core networks. Versions prior to 1.4.2 are vulnerable to procedure panic caused by Nil Pointer Dereference in the /sdm-subscriptions endpoint. A remote attacker can cause the UDM service to panic and crash by sending a crafted POST request to the /sdm-subscriptions endpoint with a malformed URL path containing path traversal sequences (../) and a large JSON payload. The DataChangeNotificationProcedure function in notifier.go attempts to access a nil pointer without proper validation, causing a complete service crash with "runtime error: invalid memory address or nil pointer dereference". Exploitation would result in UDM functionality disruption until recovery by restart. This issue has been fixed in version 1.4.2.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/free5gc/free5gc/issues/781 ExploitIssue TrackingPatchVendor Advisory
https://github.com/free5gc/free5gc/security/advisories/GHSA-7g27-v5wj-jr75 PatchVendor Advisory
https://github.com/free5gc/udm/commit/65d7070f4bfd016864cbbaefbd506bbc85d2fa92 Patch
https://github.com/free5gc/udm/pull/78 Issue TrackingPatch

Track CVE-2026-33064 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.7CVE-2026-33192Free5gc udm error message information leak vulnerabilityFree5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core networks. In versions prior to 1.4.2, the UDM incorrectly conv…EPSS 0.40%8.7CVE-2026-33191Free5gc udm vulnerabilityFree5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core networks. Versions prior to 1.4.2 are vulnerable to null byte …EPSS 0.58%7.5CVE-2023-46324Free5gc udm improper verification of cryptographic signature vulnerabilitypkg/suci/suci.go in free5GC udm before 1.2.0, when Go before 1.19 is used, allows an Invalid Curve Attack because it may compute a shared secret via …EPSS 0.41%6.9CVE-2026-33065Free5gc udm error message information leak vulnerabilityFree5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core networks. In versions prior to 1.4.2, the UDM incorrectly conv…EPSS 0.43%6.6CVE-2026-27642Free5gc udm improper input validation vulnerabilityfree5gc UDM provides Unified Data Management (UDM) for free5GC, an open-source project for 5th generation (5G) mobile core networks. In versions up t…EPSS 0.65%6.6CVE-2025-69250Free5gc udm improper input validation vulnerabilityfree5gc UDM provides Unified Data Management (UDM) for free5GC, an open-source project for 5th generation (5G) mobile core networks. In versions up t…EPSS 0.41%6.6CVE-2025-69251Free5gc udm improper input validation vulnerabilityfree5gc UDM provides Unified Data Management (UDM) for free5GC, an open-source project for 5th generation (5G) mobile core networks. In versions up t…EPSS 0.48%6.6CVE-2025-69252Free5gc udm null pointer dereference vulnerabilityfree5gc UDM provides Unified Data Management (UDM) for free5GC, an open-source project for 5th generation (5G) mobile core networks. Versions up to a…EPSS 0.53%

Source: NIST National Vulnerability Database (record CVE-2026-33064), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.