CVE-2026-104597 Details
Description
libosmocore through 1.14.1 contains an out-of-bounds read in iuup_rx_initialization() in src/gsm/iuup.c. This allows a remote attacker to obtain sensitive information.
A vulnerability allowing an out-of-bounds read has been identified in libosmocore versions through 1.14.1. The issue arises in the IuUP initialization processing function, iuup_rx_initialization(), located in src/gsm/iuup.c. This vulnerability can be exploited by a remote attacker to access sensitive information.
Users can upgrade to libosmocore version 1.14.2, which addresses the vulnerability by adding proper input validation to prevent out-of-bounds reads.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 26, 2026CISA-ADP
Assessed Nov 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/osmocom/libosmocore/commit/89e5ade1a01953752a53d83da4ba0b3ddbc30e30 | [email protected] | Source CodeVendor |
| https://osmocom.org/issues/7052 | [email protected] | Issue TrackingTechnical DescriptionVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| libosmocore | >= 1.13.0, <= 1.14.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 2, 2026 | CVE Modified | CISA-ADP |
| Oct 26, 2026 | New CVE Received | [email protected] |