CVE-2025-69247 - CVE House
Back to Database
Status published Low CVE-2025-69247

free5GC has Heap Buffer Overflow in UPF Leading to Denial of Service

Vulnerability Description

free5GC go-upf is the User Plane Function (UPF) implementation for 5G networks that is part of the free5GC project. Versions prior to 1.2.8 have a Heap-based Buffer Overflow (CWE-122) vulnerability leading to Denial of Service. Remote attackers can crash the UPF network element by sending a specially crafted PFCP Session Modification Request with an invalid SDF Filter length field. This causes a heap buffer overflow, resulting in complete service disruption for all connected UEs and potential cascading failures affecting the SMF. All deployments of free5GC using the UPF component may be affected. Version 1.2.8 of go-upf contains a fix.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-69247

Credits & Attribution

No credits recorded in the NVD database.

References

More from free5gc

View All →
CVE-2025-69253
free5GC vulnerable to improper error handling in NEF with information exposure
Medium 6.6
CVE-2025-69252
free5GC has Null Pointer Dereference in UDM, Leading to Service Panic
Medium 6.6
CVE-2025-69251
free5GC has Improper Input Validation in UDM, Leading to Information Exposure
Medium 6.6
CVE-2025-69250
free5GC has Improper Error Handling in UDM, Leading to Information Exposure
Medium 6.6
CVE-2025-69248
free5GC has Array Index Out of Bounds in AMF Leading to Denial of Service
Medium 6.6

Affected Vendor

Affected Software

go-upf
Vulnerable Versions:
< 1.2.8

Timeline

Official Publish: February 23rd, 2026
Last Modified: February 25th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-122

MITRE ATT&CK TTPs

T1203 Exploitation for Client Execution
Execution
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1055 Process Injection
Defense Evasion