CVE-2026-33064 is a high-severity Nil Pointer Dereference vulnerability affecting Free5GC, an open-source 5G mobile core network project, specifically versions prior to 1.4.2 of its User Data Management (UDM) service. A remote, unauthenticated attacker can exploit this by sending a crafted POST request to the /sdm-subscriptions endpoint with a malformed URL path and large JSON payload, causing the UDM service to panic and crash. This results in a complete denial of service for the UDM, requiring a restart for recovery. With a CVSS score of 7.5 (HIGH), the vulnerability has a network-based attack vector and a high impact on availability. There is currently no evidence of active exploitation, public exploit code, or significant community discussion regarding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 1.4.2CPE matchmatch criteria | cpe:2.3:a:free5gc:udm:*:*:*:*:*:go:*:* |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.