Loading vulnerability…
CVE-2025-29632 is a buffer overflow vulnerability in Free5GC v4.0.0. The issue is described as affecting the AMF and NGAP processing path, specifically including security.go, handler_generated.go, handleInitialUEMessageMain, DecodePlainNasNoIntegrityCheck, and GetSecurityHeaderType. Based on the available information, a remote attacker can trigger the flaw by sending crafted input to the vulnerable NAS/NGAP handling logic, leading to memory corruption and process instability. The provided details indicate the primary observed outcome is denial of service.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository provides a proof-of-concept exploit for CVE-2025-29632, a denial-of-service vulnerability in free5GC (version 4.0.0 and earlier). The vulnerability arises from improper validation of the nASPDU field in InitialUEMessage processing, allowing an attacker to send a specially crafted NGAP message that causes the AMF component to crash. The repository contains three files: a README.md describing the vulnerability and usage, a free5gc.log file showing logs before and after the attack (demonstrating the AMF crash), and poc.py, a Python script that establishes an SCTP connection to the AMF and sends the malicious NGAP message. The exploit requires network access to the AMF's SCTP port (38412) and uses hardcoded local IP addresses (127.0.0.18) for both AMF and RAN. The payload is a static byte sequence sent over SCTP, and the exploit demonstrates a denial-of-service condition by crashing the AMF. No detection scripts or fake elements are present; this is a functional POC exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
3 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.
No news coverage yet. Advisories and community discussion only.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.