CVE-2025-69252
NULL Pointer Dereference in free5gc UDM Causes DoS Crash
Publication date: 2026-02-24
Last updated on: 2026-02-25
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| free5gc | udm | to 1.4.1 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-476 | The product dereferences a pointer that it expects to be valid but is NULL. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
This vulnerability can cause the UDM service in free5GC to crash unexpectedly, leading to a Denial of Service (DoS).
Since the UDM is a critical component for managing subscriber data in 5G core networks, its unavailability can disrupt network operations and services relying on free5GC.
Attackers do not need to be authenticated to exploit this issue, increasing the risk of service disruption from remote sources.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
Can you explain this vulnerability to me?
CVE-2025-69252 is a high-severity NULL Pointer Dereference vulnerability in the Unified Data Management (UDM) component of free5GC, an open-source 5G mobile core network project.
This vulnerability affects versions up to and including 1.4.1 of free5GC UDM. Remote unauthenticated attackers can exploit this flaw by sending a specially crafted PUT request with an unexpected ueId, which causes the UDM service to crash due to a NULL pointer dereference.
The crash results in a service panic, effectively causing a Denial of Service (DoS) condition. There is no direct workaround at the application level, and the recommended mitigation is to apply the official patch provided in pull request #76.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring the UDM service for crashes or panics triggered by malformed PUT requests containing unexpected ueId values.
Since the vulnerability is triggered by a crafted PUT request, network traffic analysis tools can be used to detect suspicious PUT requests sent to the UDM component.
Specific commands are not provided in the available information, but general approaches include:
- Using network packet capture tools like tcpdump or Wireshark to filter for PUT requests to the UDM service endpoint.
- Checking system logs or service logs for unexpected crashes or panics of the UDM service.
What immediate steps should I take to mitigate this vulnerability?
The recommended immediate step is to apply the official patch provided in pull request #76 for free5gc/udm, which fixes the NULL Pointer Dereference vulnerability.
Upgrading to the next free5GC release that includes this fix is advised.
There is no direct application-level workaround available to mitigate this vulnerability.