Live › vulnerability › CVE-2026-104591
Go to dashboardlibosmocore through 1.14.1 has a buffer overflow in osmo_iuup_compute_payload_crc() in src/gsm/iuup.c. The sources say a remote attacker can cause a denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 19:32 UTC. All times on this page are UTC.
Systems running libosmocore 1.14.1 or earlier, typically open-source cellular network software (Osmocom stack) that parses Iu user-plane traffic. Sources do not say which deployments reach the vulnerable function, so teams that do not run Osmocom or libosmocore can skip it.
No product ranges from the sources yet.
pkg-config --modversion libosmocore (unknown if the sources list a fixed version)osmo_iuup_compute_payload_crc in the library or in software linked against it (unknown if the sources name a tool)1.14.1 once a fixed release is published (unknown: the sources do not name a fixed version)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
libosmocore through 1.14.1 contains a buffer overflow in osmo_iuup_compute_payload_crc() in src/gsm/iuup.c. This allows a remote attacker to cause a denial of service.
This page as .md · .json · in your agent: get_signal("CVE-2026-104591")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.