CVE-2026-42082: free5GC Privilege Escalation Vulnerability

CVE-2026-42082 Overview

CVE-2026-42082 affects free5GC, an open-source implementation of the 5G core network. The Access and Mobility Management Function (AMF) in free5GC fails to enforce concurrent security procedure rules defined in 3GPP TS 33.501 §6.9.5.1. The AMF does not check for ongoing N2 handover procedures before initiating a Non-Access Stratum (NAS) Security Mode Command, and the reverse case is also unchecked. This can cause mismatches between NAS and Access Stratum (AS) security contexts in the network and the User Equipment (UE). The issue is classified as an improperly implemented security check for standard [CWE-358]. Versions prior to 4.2.2 are affected, and the fix is included in release 4.2.2.

Critical Impact
Concurrent execution of NAS Security Mode Command and N2 handover procedures can desynchronize security contexts between the 5G core and connected user equipment, degrading integrity and availability of mobility signaling.

Affected Products

free5GC versions prior to 4.2.2
AMF component within the free5GC 5G core network implementation
Deployments relying on free5GC for NAS and N2 mobility procedures

Discovery Timeline

2026-05-27 - CVE-2026-42082 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-42082

Vulnerability Analysis

The AMF coordinates two distinct security-relevant procedures during UE mobility: the NAS Security Mode Command (SMC) and the N2 handover. 3GPP TS 33.501 §6.9.5.1 specifies that these procedures must not run concurrently because each can update or replace cryptographic contexts. free5GC's AMF does not implement the required mutual exclusion. When a NAS SMC starts while an N2 handover is in progress, or the inverse, the network and UE can end up with divergent NAS and AS keysets. The flaw is a standards conformance failure rather than a memory safety or injection issue, and it requires a position on the adjacent network with valid signaling privileges.

Root Cause

The AMF state machine lacks guard conditions that test for an active N2 handover before sending a NAS Security Mode Command, and it lacks the symmetrical check before accepting or initiating an N2 handover while an SMC is outstanding. This omission contradicts the concurrency constraints in 3GPP TS 33.501 §6.9.5.1 and is tracked as an Improper Adherence to Coding Standards [CWE-358].

Attack Vector

The attack vector is adjacent network with high complexity and low privileges, requiring no user interaction. An adversary capable of influencing the timing of N2 or NAS signaling toward the AMF can interleave a handover with an SMC. The resulting NAS/AS context mismatch can cause signaling failures, dropped sessions, or inconsistent integrity protection state between the UE and the core. Confidentiality is not directly affected, while integrity and availability impacts are limited in scope.

No public proof-of-concept code is available. See the GitHub Security Advisory GHSA-vrrx-58h3-prmh for protocol-level details.

Detection Methods for CVE-2026-42082

Indicators of Compromise

Repeated NAS Security Mode Command messages overlapping with N2 handover request or N2 handover required signaling for the same UE
UE registration or service request failures following handover completion, particularly with integrity check failures
AMF logs showing simultaneous active procedures for the same amfUeNgapId or ranUeNgapId

Detection Strategies

Correlate AMF procedure state logs to identify overlapping NAS SMC and N2 handover transactions per subscriber
Inspect NGAP and NAS message traces on the N2 interface for handover messages emitted while an SMC exchange is incomplete
Alert on anomalous rates of NAS integrity verification failures immediately following handover events

Monitoring Recommendations

Enable verbose procedure-level logging on the AMF and forward logs to a centralized analytics platform for sequence analysis
Baseline normal NAS SMC and N2 handover rates per gNB and flag deviations
Track free5GC release versions across deployments and alert on instances running versions prior to 4.2.2

How to Mitigate CVE-2026-42082

Immediate Actions Required

Upgrade free5GC to version 4.2.2 or later, which enforces the concurrency rules from 3GPP TS 33.501 §6.9.5.1
Inventory all AMF deployments and confirm version status before further mobility signaling testing
Restrict N2 interface exposure to trusted gNBs using network segmentation and mutual authentication

Patch Information

The vulnerability is fixed in free5GC release 4.2.2. The fix introduces checks in the AMF that prevent initiating a NAS Security Mode Command while an N2 handover is in progress, and prevent initiating an N2 handover while a NAS SMC is outstanding. Refer to the free5GC GitHub Security Advisory GHSA-vrrx-58h3-prmh for commit-level details and upgrade instructions.

Workarounds

No vendor-supplied workaround exists; upgrading to free5GC 4.2.2 is the only supported remediation
Limit access to the N2 interface to authenticated gNBs and isolate the AMF control plane on a dedicated management network
Monitor AMF procedure logs for overlapping NAS SMC and N2 handover events until the patched version is deployed

bash

# Verify the running free5GC AMF version and upgrade if below 4.2.2
git -C /opt/free5gc describe --tags
# Expected output: v4.2.2 or later