CVE-2026-104596
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
libosmocore through 1.14.1 contains out-of-bounds reads in the GSM 04.80 supplementary-service component parsers in src/gsm/gsm0480.c. This allows a remote attacker to obtain sensitive information.
Risk Assessment
A remote attacker could exploit this vulnerability to leak data from process memory, potentially exposing sensitive information. This may lead to a breach of communication confidentiality.
Recommendation
Update libosmocore to a version later than 1.14.1 that contains the fix. Until then, restrict access to services using this library.
Other vulnerabilities in libosmocore
See all- CVE-2026-104597High
libosmocore through 1.14.1 contains an out-of-bounds read in iuup_rx_initialization() in src/gsm/iuup.c. This allows a remote attacker to obtain sensitive information.
- CVE-2026-104594High
libosmocore through 1.14.1 contains out-of-bounds reads in the IPA CCM identity-tag parsers in src/gsm/ipa.c. This allows a remote attacker to obtain sensitive information.
- CVE-2026-104592Medium
libosmocore through 1.14.1 contains an out-of-bounds read in the CBSP WRITE-REPLACE decoder in src/gsm/cbsp.c. This allows a remote attacker to cause a denial of service.
- CVE-2026-104591High
libosmocore through 1.14.1 contains a buffer overflow in osmo_iuup_compute_payload_crc() in src/gsm/iuup.c. This allows a remote attacker to cause a denial of service.
Original NVD description (English source)
libosmocore through 1.14.1 contains out-of-bounds reads in the GSM 04.80 supplementary-service component parsers in src/gsm/gsm0480.c. This allows a remote attacker to obtain sensitive information.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS