CVE-2026-104592
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
libosmocore through 1.14.1 contains an out-of-bounds read in the CBSP WRITE-REPLACE decoder in src/gsm/cbsp.c. This allows a remote attacker to cause a denial of service.
Risk Assessment
A remote attacker could exploit the out-of-bounds read to cause a crash or instability of services using libosmocore. This may lead to unavailability of telecommunications services.
Recommendation
Update libosmocore to a version later than 1.14.1 that contains the fix. Until then, limit exposure of services using libosmocore to untrusted networks.
Other vulnerabilities in libosmocore
See all- CVE-2026-104597High
libosmocore through 1.14.1 contains an out-of-bounds read in iuup_rx_initialization() in src/gsm/iuup.c. This allows a remote attacker to obtain sensitive information.
- CVE-2026-104596High
libosmocore through 1.14.1 contains out-of-bounds reads in the GSM 04.80 supplementary-service component parsers in src/gsm/gsm0480.c. This allows a remote attacker to obtain sensitive information.
- CVE-2026-104594High
libosmocore through 1.14.1 contains out-of-bounds reads in the IPA CCM identity-tag parsers in src/gsm/ipa.c. This allows a remote attacker to obtain sensitive information.
- CVE-2026-104591High
libosmocore through 1.14.1 contains a buffer overflow in osmo_iuup_compute_payload_crc() in src/gsm/iuup.c. This allows a remote attacker to cause a denial of service.
Original NVD description (English source)
libosmocore through 1.14.1 contains an out-of-bounds read in the CBSP WRITE-REPLACE decoder in src/gsm/cbsp.c. This allows a remote attacker to cause a denial of service.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS