What is the CVSS score of CVE-2025-70122?

CVE-2025-70122 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of Free5gc are affected by CVE-2025-70122?

A critical denial-of-service vulnerability in free5GC's UPF component (CVE-2025-70122) allows remote attackers to crash 5G network infrastructure through malformed session modification requests.

Is there a public PoC exploit available for CVE-2025-70122?

Yes, a public proof-of-concept exploit is available for CVE-2025-70122. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-70122?

Within 24 hours: Inventory all free5GC v4.0.1 deployments and assess production exposure; enable detailed logging on PFCP traffic for forensic capability. Within 7 days: Implement network-level controls isolating UPF components from untrusted networks; deploy WAF/IDS rules to detect and block malformed PFCP Session Modification Requests; establish incident response procedures for DoS events. Within 30 days: Prepare upgrade path to patched free5GC version when available; consider architectural changes to implement UPF redundancy and failover mechanisms to improve resilience.

Free5gc CVE-2025-70122

HIGH

Heap-based Buffer Overflow (CWE-122)

2026-02-13 cve@mitre.org

Buffer Overflow Denial Of Service Free5gc

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

PoC Detected

Feb 18, 2026 - 15:40 vuln.today

Public exploit code

CVE Published

Feb 13, 2026 - 17:16 nvd

HIGH 7.5

DescriptionCVE.org

A heap buffer overflow vulnerability in the UPF component of free5GC v4.0.1 allows remote attackers to cause a denial of service via a crafted PFCP Session Modification Request. The issue occurs in the SDFFilterFields.UnmarshalBinary function (sdf-filter.go) when processing a declared length that exceeds the actual buffer capacity, leading to a runtime panic and UPF crash.

AnalysisAI

A heap buffer overflow vulnerability in the UPF component of free5GC v4.0.1 allows remote attackers to cause a denial of service via a crafted PFCP Session Modification Request. [CVSS 7.5 HIGH]

Technical ContextAI

Classified as CWE-122 (Heap-based Buffer Overflow). Affects the UPF component of Free5Gc. A heap buffer overflow vulnerability in the UPF component of free5GC v4.0.1 allows remote attackers to cause a denial of service via a crafted PFCP Session Modification Request. The issue occurs in the SDFFilterFields.UnmarshalBinary function (sdf-filter.go) when processing a declared length that exceeds the actual buffer capacity, leading to a runtime panic and UPF crash.

RemediationAI

Monitor vendor advisories for a patch. Enable ASLR, DEP/NX, and stack canaries where possible. Restrict network access to the affected service where possible.