CVE-2026-5360

A vulnerability has been found in Free5GC 4.2.0. The affected element is an unknown function of the component aper. Such manipulation leads to type confusion. The attack may be launched remotely. This attack is characterized by high complexity. The exploitability is described as difficult. The exploit has been disclosed to the public and may be used. The name of the patch is 26205eb01705754b7b902ad6c4b613c96c881e29. It is best practice to apply a patch to resolve this issue.

CVSS v3 3.7 LOW
CVSS v2.0 2.6 LOW

3.7^/10

CVSS v3 : LOW

Vector :

Exploitability : 2.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

2.6^/10

CVSS v2.0 : LOW

Vector : AV:N/AC:H/Au:N/C:N/I:N/A:P

Exploitability : 4.9 / Impact : 2.9

Access Vector NETWORK

Access Complexity HIGH

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References

Link	Resource
https://github.com/free5gc/aper/commit/26205eb01705754b7b902ad6c4b613c96c881e29	Patch
https://github.com/free5gc/aper/pull/11	Issue Tracking Patch
https://github.com/free5gc/free5gc/	Product
https://github.com/free5gc/free5gc/issues/831	Issue Tracking
https://github.com/free5gc/free5gc/issues/831#issue-3996453112	Issue Tracking
https://vuldb.com/submit/781573	Third Party Advisory VDB Entry
https://vuldb.com/vuln/354735	Third Party Advisory VDB Entry
https://vuldb.com/vuln/354735/cti	Permissions Required VDB Entry

Configurations

Configuration 1 (hide)

cpe:2.3:a:free5gc:free5gc:4.2.0:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-04-02 17:16

Updated : 2026-07-24 20:10

NVD link : CVE-2026-5360

Mitre link : CVE-2026-5360

CVE.ORG link : CVE-2026-5360

JSON object : View

Products Affected

free5gc

free5gc

CWE

CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

{"id": "CVE-2026-5360", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-5360", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-03T19:59:15.436297Z"}}], "cvssMetricV2": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"version": "2.0", "baseScore": 2.6, "accessVector": "NETWORK", "vectorString": "AV:N/AC:H/Au:N/C:N/I:N/A:P", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "HIGH", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 4.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.2}], "cvssMetricV40": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cna@vuldb.com", "affectedData": [{"cpes": ["cpe:2.3:a:free5gc:free5gc:*:*:*:*:*:*:*:*"], "vendor": "n/a", "modules": ["aper"], "product": "Free5GC", "versions": [{"status": "affected", "version": "4.2.0"}]}]}], "published": "2026-04-02T17:16:32.733", "references": [{"url": "https://github.com/free5gc/aper/commit/26205eb01705754b7b902ad6c4b613c96c881e29", "tags": ["Patch"], "source": "cna@vuldb.com"}, {"url": "https://github.com/free5gc/aper/pull/11", "tags": ["Issue Tracking", "Patch"], "source": "cna@vuldb.com"}, {"url": "https://github.com/free5gc/free5gc/", "tags": ["Product"], "source": "cna@vuldb.com"}, {"url": "https://github.com/free5gc/free5gc/issues/831", "tags": ["Issue Tracking"], "source": "cna@vuldb.com"}, {"url": "https://github.com/free5gc/free5gc/issues/831#issue-3996453112", "tags": ["Issue Tracking"], "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/submit/781573", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/vuln/354735", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/vuln/354735/cti", "tags": ["Permissions Required", "VDB Entry"], "source": "cna@vuldb.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "cna@vuldb.com", "description": [{"lang": "en", "value": "CWE-843"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in Free5GC 4.2.0. The affected element is an unknown function of the component aper. Such manipulation leads to type confusion. The attack may be launched remotely. This attack is characterized by high complexity. The exploitability is described as difficult. The exploit has been disclosed to the public and may be used. The name of the patch is 26205eb01705754b7b902ad6c4b613c96c881e29. It is best practice to apply a patch to resolve this issue."}, {"lang": "es", "value": "Se ha encontrado una vulnerabilidad en Free5GC 4.2.0. El elemento afectado es una funci\u00f3n desconocida del componente aper. Dicha manipulaci\u00f3n conduce a confusi\u00f3n de tipos. El ataque puede ser lanzado remotamente. Este ataque se caracteriza por alta complejidad. La explotabilidad se describe como dif\u00edcil. El exploit ha sido divulgado al p\u00fablico y puede ser utilizado. El nombre del parche es 26205eb01705754b7b902ad6c4b613c96c881e29. Es una buena pr\u00e1ctica aplicar un parche para resolver este problema."}], "lastModified": "2026-07-24T20:10:00.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:free5gc:free5gc:4.2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "481873CA-A3CB-4D59-93FF-B84056A2CA43"}], "operator": "OR"}]}], "sourceIdentifier": "cna@vuldb.com"}