High severity · published Feb 23, 2026
CVE-2025-69252
free5GC has Null Pointer Dereference in UDM, Leading to Service Panic
7.5
CVSS
0.6%
EPSS
No
On KEV
Description
free5gc UDM provides Unified Data Management (UDM) for free5GC, an open-source project for 5th generation (5G) mobile core networks. Versions up to and including 1.4.1 have a NULL Pointer Dereference vulnerability. Remote unauthenticated attackers can trigger a service panic (Denial of Service) by sending a crafted PUT request with an unexpected ueId, crashing the UDM service. All deployments of free5GC using the UDM component may be affected. free5gc/udm pull request 76 contains a fix for the issue. No direct workaround is available at the application level. Applying the official patch is recommended.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 48% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UD
udm · free5gc
<= 1.4.1 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-69252
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-69252
Exploit
https://github.com/free5gc/free5gc/issues/752
Patch
https://github.com/free5gc/free5gc/security/advisories/GHSA-v8cv-qvf6-9rpm
Patch
https://github.com/free5gc/udm/commit/504b14458d156558b3c0ade7107b86b3d5e72998
Issue Tracking
https://github.com/free5gc/udm/pull/76
More from udm
8.6
CVE-2026-33191
free5GC UDM vulnerable to null byte injection in URL path parameters causing 500 Internal Server Error
7.5
CVE-2026-33064
free5GC UDM DataChangeNotification Procedure Panic Due to Nil Pointer Dereference
7.5
CVE-2026-27642
free5GC has Improper Input Validation in UDM UEAU Service
7.5
CVE-2025-69250
free5GC has Improper Error Handling in UDM, Leading to Information Exposure
7.5
CVE-2023-46324
pkg/suci/suci.go in free5GC udm before 1.2.0, when Go before 1.19 is used, allows an Invalid Curve Attack because it may compute a shared secret via an uncompressed public key…