Exploitability of malformed MobileIdentity5GS inputs accepted by the defective patch

Determine whether malformed pre-authentication NAS RegistrationRequest inputs containing violating MobileIdentity5GS values, which are silently accepted because the validation block in free5GC nas v1.2.3 is unreachable, are individually exploitable through downstream code.

Background

CVE-2025-69248 concerns an AMF panic in free5GC’s MobileIdentity5GS decoder caused by a malformed pre-authentication NAS RegistrationRequest. Although the v1.2.3 patch closes the original panic path, its additional defense-in-depth validation block is ineffective because it reads from a zero-allocated buffer before the wire bytes are copied and applies an incorrect mask to the identity-type field.

Seven unit tests demonstrate that malformed MobileIdentity5GS values—including undersized GUTI, IMEI, 5G-S-TMSI, and SUCI values, undefined identity types, and an oversized length—are accepted despite the intended validation. The paper explicitly leaves unresolved whether these accepted inputs are individually exploitable through downstream code.