Executive brief
A vulnerability exists in Free5GC, an open-source 5G core network platform. The software fails to properly validate certain data strings (PrintableStrings) during network signaling, which could allow a remote attacker to send specially crafted packets that cause the system to crash or behave unexpectedly. This could lead to a partial disruption of mobile network services.
Technical details
A type confusion vulnerability exists in the 'aper' component of Free5GC 4.2.0 due to improper validation of 'PrintableString' types according to the X.680 specification. The root cause is located in the APER decoding logic, where the system accepts non-printable characters in fields where only printable strings are permitted (e.g., RANNodeName in NGSetupRequest). A remote attacker can exploit this by sending malformed NGAP packets. While the initial impact is described as low, processing these unvalidated values in subsequent logic can lead to application crashes or undefined behavior. A patch has been released in the 'aper' repository to enforce X.680 validation.
Affected products
- Free5GC Free5GC 4.2.0
Timeline
- 2026-02-26: disclosed: Issue reported on GitHub
- 2026-03-17: patched: Fix merged into main branch of aper repository
- 2026-04-02: advisory: Vulnerability published by VulDB/NVD
References
- https://github.com/free5gc/aper/commit/26205eb01705754b7b902ad6c4b613c96c881e29
- https://github.com/free5gc/aper/pull/11
- https://github.com/free5gc/free5gc/
- https://github.com/free5gc/free5gc/issues/831
- https://github.com/free5gc/free5gc/issues/831
- https://vuldb.com/submit/781573
- https://vuldb.com/vuln/354735