Live › vulnerability › CVE-2026-104596
Go to dashboardlibosmocore through 1.14.1 has out-of-bounds reads in the GSM 04.80 supplementary-service component parsers in src/gsm/gsm0480.c. A remote attacker can use crafted input to read memory outside the buffer and obtain sensitive information.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 20:50 UTC. All times on this page are UTC.
Systems that link libosmocore and parse GSM 04.80 supplementary-service messages, typical in cellular network and telecom test software such as OsmoBTS-style or GSM stack deployments. Applications that do not process GSM 04.80 components are likely unaffected, but the sources do not confirm the exact exposed code path.
No product ranges from the sources yet.
pkg-config --modversion libosmocore or the package manager; unknown whether a specific build is confirmed vulnerable beyond 1.14.1 and earlier.1.14.1; the sources do not name the fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
libosmocore through 1.14.1 contains out-of-bounds reads in the GSM 04.80 supplementary-service component parsers in src/gsm/gsm0480.c. This allows a remote attacker to obtain sensitive information.
This page as .md · .json · in your agent: get_signal("CVE-2026-104596")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.