CVE-2025-70121
Published: 13 February 2026
Summary
CVE-2025-70121 is a high-severity Out-of-bounds Read (CWE-125) vulnerability in Free5Gc Free5Gc. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 44.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-11 (Error Handling).
Deeper analysis
CVE-2025-70121 is an array index out of bounds vulnerability, classified under CWE-125, affecting the AMF component in free5GC version 4.0.1. The issue arises in the GetSUCI method of the NAS_MobileIdentity5GS.go file, where the code accesses index 5 of a 5-element array while processing a 5GS Mobile Identity from a NAS Registration Request message. This triggers a runtime panic, resulting in an AMF crash.
The vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating it is exploitable remotely with low complexity, no privileges, and no user interaction required. Unauthenticated remote attackers can send a crafted NAS Registration Request containing a malformed 5GS Mobile Identity to provoke the out-of-bounds access, achieving denial of service by crashing the AMF and disrupting 5G core network services.
Details on the vulnerability, including potential patches or workarounds, are documented in the free5GC GitHub repository issue at https://github.com/free5gc/free5gc/issues/747, published on 2026-02-13. Security practitioners should review this advisory for mitigation guidance and upgrade recommendations.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-207533
Vulnerability details
An array index out of bounds vulnerability in the AMF component of free5GC v4.0.1 allows remote attackers to cause a denial of service via a crafted 5GS Mobile Identity in a NAS Registration Request message. The issue occurs in the…
more
GetSUCI method (NAS_MobileIdentity5GS.go) when accessing index 5 of a 5-element array, leading to a runtime panic and AMF crash.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Array bounds vulnerability enables remote unauthenticated crash of AMF service via crafted NAS message, directly matching application/system exploitation for DoS.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires validation of the 5GS Mobile Identity in NAS Registration Request messages to prevent out-of-bounds array access in the GetSUCI method.
Mandates error handling that avoids runtime panic and AMF crash when processing malformed array indices in the NAS_MobileIdentity5GS.go file.
Protects against denial-of-service from unauthenticated remote crafted requests by limiting traffic and preventing resource exhaustion in the AMF component.