CVE-2026-1739: Free5GC pcf smpolicy.go HandleCreateSmPolicyRequest null pointer dereference
A vulnerability has been found in Free5GC pcf up to 1.4.1. This affects the function HandleCreateSmPolicyRequest of the file internal/sbi/processor/smpolicy.go. The manipulation leads to null pointer dereference. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is df535f5524314620715e842baf9723efbeb481a7. Applying a patch is the recommended action to fix this issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-1739?
CVE-2026-1739 has been classified with a severity that allows attackers to exploit null pointer dereference vulnerabilities.
How do I fix CVE-2026-1739?
To fix CVE-2026-1739, update Free5GC to version 1.4.2 or later, where the vulnerability is addressed.
What component is affected by CVE-2026-1739?
CVE-2026-1739 affects the HandleCreateSmPolicyRequest function in the smpolicy.go file of Free5GC's PCF module.
What could an attacker achieve by exploiting CVE-2026-1739?
An attacker exploiting CVE-2026-1739 could trigger a null pointer dereference, leading to application crashes and potential denial of service.
Which versions of Free5GC are vulnerable to CVE-2026-1739?
Free5GC versions up to and including 1.4.1 are vulnerable to CVE-2026-1739.