# CVE-2026-41218: F5 BIG-IP TMM use-after-free in PEM iRules

Source: https://junglewise.ai/threats/cve-2026-41218-f5-big-ip-tmm-use-after-free-in-pem-irules  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-13. Updated: 2026-06-24  
License: CC BY 4.0 with a link back

CVE-2026-41218 · Severity: high · CVSS 7.5 · Published 2026-05-13

A vulnerability in F5 BIG-IP devices can allow an attacker to crash the system's core traffic processing engine. This affects devices configured with specific Policy Enforcement Manager (PEM) rules used for traffic classification and analytics. An exploit would result in a complete service outage, preventing the device from handling network traffic and potentially disrupting business operations.

Technologies: [F5 BIG-IP APM](https://junglewise.ai/threats/technologies/big-ip-apm). Vendors: [F5](https://junglewise.ai/threats/vendors/f5).

## Quick answers

**Is CVE-2026-41218 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41218 being exploited in the wild.

**How severe is CVE-2026-41218?** High severity, with a CVSS score of 7.5, published 13 May 2026.

**Which products and versions are affected?** F5 BIG-IP AFM 16.1.0 - 16.1.6, 17.5.0 - 17.5.1, 21.0.0; F5 BIG-IP APM 16.1.0 - 16.1.6, 17.5.0 - 17.5.1, 21.0.0; F5 BIG-IP LTM 16.1.0 - 16.1.6, 17.5.0 - 17.5.1, 21.0.0; F5 BIG-IP PEM 16.1.0 - 16.1.6, 17.5.0 - 17.5.1, 21.0.0.

**Is there a fix for CVE-2026-41218?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-41218 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-41218?** Check whether you run F5 BIG-IP AFM, F5 BIG-IP APM, F5 BIG-IP LTM or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability is classified as a Use-After-Free (CWE-416) within the Traffic Management Microkernel (TMM) of F5 BIG-IP. It is triggered when specific PEM iRules are configured on a virtual server, specifically those utilizing commands such as CLASSIFICATION::, CLASSIFY::, PEM::, PSC::, or urlcatquery. A remote, unauthenticated attacker can send specially crafted network traffic to the affected virtual server to cause TMM to terminate, resulting in a denial-of-service (DoS). The issue affects multiple BIG-IP modules including PEM, LTM, AFM, and APM across versions 16.1.x, 17.5.x, and 21.0.0. F5 has released a vendor advisory with mitigation and patching information.

## Affected products

- F5 BIG-IP PEM 16.1.0 - 16.1.6, 17.5.0 - 17.5.1, 21.0.0
- F5 BIG-IP APM 16.1.0 - 16.1.6, 17.5.0 - 17.5.1, 21.0.0
- F5 BIG-IP AFM 16.1.0 - 16.1.6, 17.5.0 - 17.5.1, 21.0.0
- F5 BIG-IP LTM 16.1.0 - 16.1.6, 17.5.0 - 17.5.1, 21.0.0

## Timeline

- 2026-05-13: advisory: Initial publication of the vulnerability advisory

## References

- [https://my.f5.com/manage/s/article/K000160875](https://my.f5.com/manage/s/article/K000160875)

## Related threats

- [F5 BIG-IP APM heap-based buffer overflow](https://junglewise.ai/threats/cve-2026-94127-f5-big-ip-apm-heap-based-buffer-overflow)
- [F5 BIG-IP APM buffer overflow in apmd process](https://junglewise.ai/threats/cve-2026-40067-f5-big-ip-apm-buffer-overflow-in-apmd-process)