{"id":"CVE-2026-104594","kind":"vulnerability","aliases":["CVE-2026-104594"],"related":[],"title":"libosmocore: out-of-bounds reads in IPA identity parsing leak memory","description":"libosmocore through 1.14.1 contains out-of-bounds reads in the IPA CCM identity-tag parsers in src/gsm/ipa.c. This allows a remote attacker to obtain sensitive information.","summary":"libosmocore through 1.14.1 has out-of-bounds reads in the IPA CCM identity-tag parsers in src/gsm/ipa.c. A remote attacker can use these reads to obtain sensitive information from process memory.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gsm","libosmocore","osmocom","other","telecom"],"not_affected_if":["no-ipa-listener"],"how_to_check":"- Check the installed libosmocore version with `pkg-config --modversion libosmocore` or the package manager.\n- Confirm whether IPA (Osmocom IPA over TCP/UDP) handling from libosmocore is in use, for example in osmo-bsc, osmo-msc, osmo-hlr or osmo-bts.","fix":"- Move to a libosmocore release newer than `1.14.1` once one that contains the fix is published; the sources do not name the fixed version.","status":"open","published_at":"2026-10-26T19:16:28+00:00","first_seen_at":"2026-10-26T19:32:06+00:00","triaged_at":"2026-10-26T19:34:02+00:00","updated_at":"2026-10-26T19:34:02+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-10-26T19:34:02Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a libosmocore release newer than `1.14.1` once one that contains the fix is published; the sources do not name the fixed version.","reach":"network","title":"libosmocore: out-of-bounds reads in IPA identity parsing leak memory","impact":"low","summary":"libosmocore through 1.14.1 has out-of-bounds reads in the IPA CCM identity-tag parsers in src/gsm/ipa.c. A remote attacker can use these reads to obtain sensitive information from process memory.","category":"other","nicknames":[],"who_cares":["libosmocore","osmocom","telecom","gsm"],"confidence":0.4,"needs_auth":"unknown","worst_case":"Remote attacker reads sensitive process memory via out-of-bounds parsing","analyst_note":"Find the NVD entry's CVSS and the upstream libosmocore commit or advisory to confirm the fixed version and which IPA ports are exposed.","how_to_check":"- Check the installed libosmocore version with `pkg-config --modversion libosmocore` or the package manager.\n- Confirm whether IPA (Osmocom IPA over TCP/UDP) handling from libosmocore is in use, for example in osmo-bsc, osmo-msc, osmo-hlr or osmo-bts.","needs_analyst":true,"not_affected_if":["no-ipa-listener"],"who_is_affected":"Systems that run software built on libosmocore and accept IPA connections from remote peers are exposed, typically Osmocom-based cellular network components. Systems that do not use libosmocore's IPA parsing can skip it. The sources do not say which downstream products are affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000633,"input_tokens":3296,"output_tokens":607,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-104594':15A,18A '-2026':14A,17A '1.14.1':26B,59C 'allow':77C 'attack':45B,80C 'bound':5A,31B,64C 'ccm':36B,69C 'contain':60C 'cve':13A,16A 'gsm':19B 'ident':9A,38B,71C 'identity-tag':37B,70C 'inform':53B,84C 'ipa':8A,35B,68C 'leak':11A 'libosmocor':1A,20B,24B,57C 'memori':12A,56B 'obtain':51B,82C 'osmocom':21B 'out-of-bound':2A,28B,61C 'pars':10A 'parser':40B,73C 'process':55B 'read':6A,32B,49B,65C 'remot':44B,79C 'sensit':52B,83C 'src/gsm/ipa.c':42B,75C 'tag':39B,72C 'telecom':23B 'use':47B","nicknames":[],"mitigations":[],"who_affected":"Systems that run software built on libosmocore and accept IPA connections from remote peers are exposed, typically Osmocom-based cellular network components. Systems that do not use libosmocore's IPA parsing can skip it. The sources do not say which downstream products are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T19:16:28+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-104594","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104594","severity":null,"published_at":"2026-10-26T19:16:28+00:00","modified_at":"2026-10-26T19:16:28+00:00","first_seen_at":"2026-10-26T19:32:06+00:00","fetched_at":"2026-10-26T19:32:06+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}