CVE-2026-104594
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
libosmocore through 1.14.1 contains out-of-bounds reads in the IPA CCM identity-tag parsers in src/gsm/ipa.c. This allows a remote attacker to obtain sensitive information.
Risk Assessment
A remote attacker could exploit the out-of-bounds read to disclose sensitive data from process memory. This may lead to leakage of sensitive information and weaken system confidentiality.
Recommendation
Update libosmocore to a version later than 1.14.1 that contains the fix. Until then, limit exposure of services using libosmocore to untrusted networks.
Other vulnerabilities in libosmocore
See all- CVE-2026-104597High
libosmocore through 1.14.1 contains an out-of-bounds read in iuup_rx_initialization() in src/gsm/iuup.c. This allows a remote attacker to obtain sensitive information.
- CVE-2026-104596High
libosmocore through 1.14.1 contains out-of-bounds reads in the GSM 04.80 supplementary-service component parsers in src/gsm/gsm0480.c. This allows a remote attacker to obtain sensitive information.
- CVE-2026-104592Medium
libosmocore through 1.14.1 contains an out-of-bounds read in the CBSP WRITE-REPLACE decoder in src/gsm/cbsp.c. This allows a remote attacker to cause a denial of service.
- CVE-2026-104591High
libosmocore through 1.14.1 contains a buffer overflow in osmo_iuup_compute_payload_crc() in src/gsm/iuup.c. This allows a remote attacker to cause a denial of service.
Original NVD description (English source)
libosmocore through 1.14.1 contains out-of-bounds reads in the IPA CCM identity-tag parsers in src/gsm/ipa.c. This allows a remote attacker to obtain sensitive information.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS