CVE-2026-42082 free5gc CVE debrief

Who should care

Telecommunications operators deploying free5GC-based 5G core networks, mobile network security engineers, and organizations responsible for 5G infrastructure security governance should prioritize this advisory. The vulnerability specifically affects environments where N2 handover procedures and NAS security operations may overlap, potentially impacting subscriber authentication and session integrity.

Technical summary

The free5GC AMF component prior to version 4.2.2 contains a logic flaw in its handling of concurrent security procedures. Specifically, the AMF does not verify whether an N2 handover procedure is in progress before initiating a NAS Security Mode Command, and conversely does not check for ongoing NAS security procedures before handling N2 handover operations. This violates the concurrent security procedure rules defined in 3GPP TS 33.501 section 6.9.5.1, which are designed to prevent race conditions that could lead to mismatched security contexts between the network and UE. The vulnerability could allow an attacker with adjacent network access and low privileges to cause integrity and availability impacts through security context desynchronization. The attack requires high complexity due to timing constraints. The issue is resolved in free5GC version 4.2.2.

Defensive priority

LOW

Recommended defensive actions

• Upgrade free5GC to version 4.2.2 or later to address the security context synchronization issue.
• Review AMF configurations to ensure proper enforcement of concurrent security procedures per 3GPP TS 33.501 §6.9.5.1.
• Monitor for anomalous NAS signaling patterns that may indicate attempted exploitation of security context mismatches.
• Validate that N2 handover procedures and NAS Security Mode Command operations are properly sequenced in operational deployments.

Evidence notes

The vulnerability description is sourced from the official CVE record and NVD entry. The fix version 4.2.2 is confirmed in the security advisory. The CVSS vector indicates attack complexity is high (AC:H), privileges required are low (PR:L), and the attack vector is adjacent network (AV:A).

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.