High severity · published Feb 2, 2026
CVE-2026-1739
Free5GC pcf smpolicy.go HandleCreateSmPolicyRequest null pointer dereference
7.5
CVSS
0.8%
EPSS
No
On KEV
Description
A vulnerability has been found in Free5GC pcf up to 1.4.1. This affects the function HandleCreateSmPolicyRequest of the file internal/sbi/processor/smpolicy.go. The manipulation leads to null pointer dereference. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is df535f5524314620715e842baf9723efbeb481a7. Applying a patch is the recommended action to fix this issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 56% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PC
pcf · Free5GC
1.4.0; 1.4.1 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-1739
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-1739
Exploit
https://github.com/free5gc/free5gc/issues/803
Exploit
https://github.com/free5gc/free5gc/issues/803#issue-3815770007
Product
https://github.com/free5gc/pcf/
Patch
https://github.com/free5gc/pcf/commit/df535f5524314620715e842baf9723efbeb481a7
Issue Tracking
https://github.com/free5gc/pcf/pull/62
Permissions Required
https://vuldb.com/?ctiid.343638
More from pcf
7.5
CVE-2026-41135
free5GC PCF: Memory Leak via CORS Middleware Registration in HTTP Handler Leads to Denial of Service
7.5
CVE-2025-66720
Null pointer dereference in free5gc pcf 1.4.0 in file internal/sbi/processor/ampolicy.go in function HandleDeletePoliciesPolAssoId