Live › vulnerability › CVE-2026-104594
Go to dashboardlibosmocore through 1.14.1 has out-of-bounds reads in the IPA CCM identity-tag parsers in src/gsm/ipa.c. A remote attacker can use these reads to obtain sensitive information from process memory.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 19:32 UTC. All times on this page are UTC.
Systems that run software built on libosmocore and accept IPA connections from remote peers are exposed, typically Osmocom-based cellular network components. Systems that do not use libosmocore's IPA parsing can skip it. The sources do not say which downstream products are affected.
No product ranges from the sources yet.
pkg-config --modversion libosmocore or the package manager.1.14.1 once one that contains the fix is published; the sources do not name the fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
libosmocore through 1.14.1 contains out-of-bounds reads in the IPA CCM identity-tag parsers in src/gsm/ipa.c. This allows a remote attacker to obtain sensitive information.
This page as .md · .json · in your agent: get_signal("CVE-2026-104594")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.