EUVD-2026-18414
GHSA-qpxw-qvw5-7292
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (vuldb) · only source for this CVE.
CVSS VectorVendor: vuldb
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability has been found in Free5GC 4.2.0. The affected element is an unknown function of the component aper. Such manipulation leads to type confusion. The attack may be launched remotely. This attack is characterized by high complexity. The exploitability is described as difficult. The exploit has been disclosed to the public and may be used. The name of the patch is 26205eb01705754b7b902ad6c4b613c96c881e29. It is best practice to apply a patch to resolve this issue.
AnalysisAI
Type confusion in Free5GC 4.2.0's aper component allows remote attackers to trigger memory corruption and information disclosure with high attack complexity and without authentication. The vulnerability stems from improper type handling in ASN.1 parsing and has publicly available exploit code, though active exploitation at scale has not been confirmed. CVSS 6.3 with availability impact and exploit proof-of-concept disclosure warrant timely patching.
Technical ContextAI
Free5GC is an open-source 5G core network implementation. The aper component handles ASN.1 Packed Encoding Rules (PER) serialization and deserialization, critical for protocol message handling in 3GPP 5G specifications. The vulnerability (CWE-843: Type Confusion) occurs when the aper decoder fails to properly validate or track type information during message parsing, allowing an attacker to craft malformed ASN.1 PER-encoded payloads that cause the decoder to interpret data as a different type than intended. This results in out-of-bounds memory access, potential information disclosure from uninitialized or adjacent memory regions, and service disruption. The remote network-based attack vector (AV:N) indicates the vulnerability is exploitable via crafted network messages sent to any Free5GC-based 5G core service handling aper-encoded data.
RemediationAI
Upstream fix available in commit 26205eb01705754b7b902ad6c4b613c96c881e29 (referenced as PR #11 to the aper repository). Users should pull the latest aper code from the Free5GC aper GitHub repository (https://github.com/free5gc/aper/) that includes this commit and rebuild/redeploy Free5GC. Exact versioning of patched Free5GC releases should be verified via the Free5GC release page (https://github.com/free5gc/free5gc/releases/). No formal workarounds are documented; the patch must be applied. For production 5G core networks, follow change control procedures to schedule patching with minimal service disruption, and validate the patch in a staging environment before deployment.
An improper input validation and protocol compliance vulnerability in free5GC v4.0.1 allows remote attackers to cause a
An array index out of bounds vulnerability in the AMF component of free5GC v4.0.1 allows remote attackers to cause a den
A heap buffer overflow vulnerability in the UPF component of free5GC v4.0.1 allows remote attackers to cause a denial of
An issue was discovered in Free5GC v4.0.0 and v4.0.1 allowing an attacker to cause a denial of service via crafted POST
An issue was discovered in free5GC version 3.3.0, allows remote attackers to execute arbitrary code and cause a denial o
Buffer Overflow vulnerability in free5gc 3.3.0 allows attackers to cause a denial of service via crafted PFCP messages w
Buffer Overflow vulnerability in free5gc 3.3.0 allows attackers to cause a denial of service via crafted PFCP message wi
Buffer Overflow vulnerability in free5gc 3.3.0, UPF 1.2.0, and SMF 1.2.0 allows attackers to cause a denial of service v
In Free5gc v3.0.5, the AMF breaks due to malformed NAS messages. Rated high severity (CVSS 7.5), this vulnerability is r
Free5gc v3.2.1 is vulnerable to Information disclosure. Rated high severity (CVSS 7.5), this vulnerability is remotely e
Cross-Site Request Forgery vulnerability, whose exploitation could allow an attacker to perform different actions on the
Denial of service in Free5GC 4.2.0 NGSetupRequest Handler allows unauthenticated remote attackers to crash the AMF (Acce
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today