CVE-2025-70121
Published: 13 February 2026
Summary
CVE-2025-70121 is a high-severity Out-of-bounds Read (CWE-125) vulnerability in Free5Gc Free5Gc. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 44.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Threat & Defense at a Glance
Threat & Defense Details
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Array bounds vulnerability enables remote unauthenticated crash of AMF service via crafted NAS message, directly matching application/system exploitation for DoS.
NVD Description
An array index out of bounds vulnerability in the AMF component of free5GC v4.0.1 allows remote attackers to cause a denial of service via a crafted 5GS Mobile Identity in a NAS Registration Request message. The issue occurs in the…
more
GetSUCI method (NAS_MobileIdentity5GS.go) when accessing index 5 of a 5-element array, leading to a runtime panic and AMF crash.
Deeper analysisAI
CVE-2025-70121 is an array index out of bounds vulnerability, classified under CWE-125, affecting the AMF component in free5GC version 4.0.1. The issue arises in the GetSUCI method of the NAS_MobileIdentity5GS.go file, where the code accesses index 5 of a 5-element array while processing a 5GS Mobile Identity from a NAS Registration Request message. This triggers a runtime panic, resulting in an AMF crash.
The vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating it is exploitable remotely with low complexity, no privileges, and no user interaction required. Unauthenticated remote attackers can send a crafted NAS Registration Request containing a malformed 5GS Mobile Identity to provoke the out-of-bounds access, achieving denial of service by crashing the AMF and disrupting 5G core network services.
Details on the vulnerability, including potential patches or workarounds, are documented in the free5GC GitHub repository issue at https://github.com/free5gc/free5gc/issues/747, published on 2026-02-13. Security practitioners should review this advisory for mitigation guidance and upgrade recommendations.
Details
- CWE(s)