CVE-2026-1973

A vulnerability was determined in Free5GC up to 4.1.0. The impacted element is the function establishPfcpSession of the component SMF. Executing a manipulation can lead to null pointer dereference. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. It is best practice to apply a patch to resolve this issue.

• CWE-404
• CWE-476
• CWE-476

• https://github.com/free5gc/free5gc/Product
• https://github.com/free5gc/free5gc/issues/815Exploit, Issue Tracking, Vendor Advisory
• https://github.com/free5gc/free5gc/issues/815#issue-3832032062Exploit, Issue Tracking, Vendor Advisory
• https://github.com/free5gc/smf/pull/189Issue Tracking
• https://vuldb.com/?ctiid.344495Permissions Required, VDB Entry
• https://vuldb.com/?id.344495Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.743236Exploit, Third Party Advisory, VDB Entry

Published

Feb 6, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-19723The Social Media Share Buttons & Social Sharing Icons WordPr…7.1
• CVE-2026-19725The WPvivid — Backup, Migration & Staging WordPress plugin b…9.1
• CVE-2026-19726The Visualizer WordPress plugin before 4.0.7 does not prope…6.5
• CVE-2026-19727Improper neutralization of input during web page generation …6.1
• CVE-2026-19728The Extra Product Options Builder for WooCommerce WordPress …7.5
• CVE-2026-19729A flaw was found in the key provider component of the keyclo…4.9
• CVE-2026-19730The 'podman quadlet install --replace' command opens the exi…4.2
• CVE-2026-19733Server-Side request forgery (SSRF) vulnerability in Yordam I…5.3
• CVE-2026-19734Missing Authorization and Authorization Bypass Through User-…8.6
• CVE-2026-19735The RFC 6528 initial-sequence-number implementation in subsy…4.8
• CVE-2026-19736The NXP MCUX TRNG entropy driver in drivers/entropy/entropy_…7.8
• CVE-2026-19737i2s_esp32_trigger_check() in drivers/i2s/i2s_esp32.c validat…5.5