Live › vulnerability › CVE-2026-104592
Go to dashboardlibosmocore, a library used in open-source cellular network software, has an out-of-bounds read in its CBSP WRITE-REPLACE message decoder in src/gsm/cbsp.c. A remote attacker can send a crafted message to cause a denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 19:32 UTC. All times on this page are UTC.
Systems that link libosmocore and decode CBSP WRITE-REPLACE messages, such as cell broadcast handling in cellular network software. The sources do not say which default configurations decode this message type or how exposed the network path is.
No product ranges from the sources yet.
pkg-config --modversion libosmocore and compare against 1.14.1cbsp.c from libosmocore1.14.1 once a fixed version is published; the sources do not name oneEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
libosmocore through 1.14.1 contains an out-of-bounds read in the CBSP WRITE-REPLACE decoder in src/gsm/cbsp.c. This allows a remote attacker to cause a denial of service.
This page as .md · .json · in your agent: get_signal("CVE-2026-104592")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.