free5gc version 4.1.0 and earlier contain a buffer overflow vulnerability that causes the AMF process to crash when it receives an UplinkRANConfigurationTransfer NGAP message from a gNB. This vulnerability has a critical severity with a CVSS score of 9.8.