Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2026-33064 is a high-severity Missing Default Case in Multiple Condition Expression (CWE-478) vulnerability in Free5Gc Udm. Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Endpoint Denial of Service (T1499); ranked at the 39th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-15 (Development Process, Standards, and Tools) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-33064 is a nil pointer dereference vulnerability in Free5GC, an open-source Linux Foundation project implementing 5G mobile core networks. It affects the User Data Management (UDM) service in versions prior to 1.4.2, specifically within the /sdm-subscriptions endpoint. The issue arises in the DataChangeNotificationProcedure function in notifier.go, which fails to validate a nil pointer when processing requests, leading to a runtime panic and service crash with the error "runtime error: invalid memory address or nil pointer dereference." The vulnerability is rated 7.5 on the CVSS 3.1 scale (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and maps to CWE-478 (Missing Default Case in Multiple Condition Expression) and CWE-476 (NULL Pointer Dereference).
A remote, unauthenticated attacker can exploit this vulnerability by sending a crafted POST request to the /sdm-subscriptions endpoint. The request must include a malformed URL path with path traversal sequences (such as ../) combined with a large JSON payload. This triggers the nil pointer access, causing the UDM service to crash completely and disrupting its functionality until manual restart or recovery mechanisms intervene. The attack requires no user interaction or privileges, enabling denial-of-service against 5G core network operations.
The vulnerability has been addressed in Free5GC version 1.4.2. Official mitigation guidance from the project's GitHub security advisory (GHSA-7g27-v5wj-jr75) and related issue (#781) recommends upgrading to the patched version. The fix is implemented via a specific commit (65d7070f4bfd016864cbbaefbd506bbc85d2fa92) in the UDM repository and merged through pull request #78, which adds proper nil pointer validation in notifier.go. Security practitioners should verify deployments and apply the update promptly to restore service stability.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-13624
Vulnerability Data
Free5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core networks. Versions prior to 1.4.2 are vulnerable to procedure panic caused by Nil Pointer Dereference in the /sdm-subscriptions endpoint. A remote attacker can cause the UDM service…
more
to panic and crash by sending a crafted POST request to the /sdm-subscriptions endpoint with a malformed URL path containing path traversal sequences (../) and a large JSON payload. The DataChangeNotificationProcedure function in notifier.go attempts to access a nil pointer without proper validation, causing a complete service crash with "runtime error: invalid memory address or nil pointer dereference". Exploitation would result in UDM functionality disruption until recovery by restart. This issue has been fixed in version 1.4.2.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation can discover missing default cases through coverage analysis or negative testing.
Requiring documented development standards and tools can enforce complete conditional handling including default cases.
Engineering principles can mandate defensive coding such as explicit null checks before dereference.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly enforce handling of all code paths including default cases via reviews and static analysis.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect missing default cases but does not guarantee their prevention.
Secure SDLC processes encourage defensive coding but do not directly mandate default-case coverage.
Application security requirements can specify input validation and pointer-safety rules.
Secure architecture principles encourage defensive design that avoids unsafe pointer use.
Secure coding standards explicitly require exhaustive switch/case handling to prevent unhandled paths.