{"id":"CVE-2026-104596","kind":"vulnerability","aliases":["CVE-2026-104596"],"related":[],"title":"libosmocore: out-of-bounds reads in GSM supplementary-service parsers leak data","description":"libosmocore through 1.14.1 contains out-of-bounds reads in the GSM 04.80 supplementary-service component parsers in src/gsm/gsm0480.c. This allows a remote attacker to obtain sensitive information.","summary":"libosmocore through 1.14.1 has out-of-bounds reads in the GSM 04.80 supplementary-service component parsers in src/gsm/gsm0480.c. A remote attacker can use crafted input to read memory outside the buffer and obtain sensitive information.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gsm","libosmocore","package","self-hosted","telecom"],"not_affected_if":["no-gsm-04.80-parsing"],"how_to_check":"- Check the installed libosmocore version with `pkg-config --modversion libosmocore` or the package manager; unknown whether a specific build is confirmed vulnerable beyond `1.14.1` and earlier.","fix":"- Move to a libosmocore release newer than `1.14.1`; the sources do not name the fixed version.","status":"open","published_at":"2026-10-26T20:17:37+00:00","first_seen_at":"2026-10-26T20:50:17+00:00","triaged_at":"2026-10-26T20:52:03+00:00","updated_at":"2026-10-26T20:52:03+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-26T20:52:03Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a libosmocore release newer than `1.14.1`; the sources do not name the fixed version.","reach":"network","title":"libosmocore: out-of-bounds reads in GSM supplementary-service parsers leak data","impact":"low","summary":"libosmocore through 1.14.1 has out-of-bounds reads in the GSM 04.80 supplementary-service component parsers in src/gsm/gsm0480.c. A remote attacker can use crafted input to read memory outside the buffer and obtain sensitive information.","category":"package","nicknames":[],"who_cares":["libosmocore","telecom","gsm","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"remote attacker reads sensitive process memory via crafted GSM messages","analyst_note":"Find the fixed libosmocore version and confirm which network-facing code paths reach gsm0480.c, using the NVD entry and the upstream libosmocore repository.","how_to_check":"- Check the installed libosmocore version with `pkg-config --modversion libosmocore` or the package manager; unknown whether a specific build is confirmed vulnerable beyond `1.14.1` and earlier.","needs_analyst":true,"not_affected_if":["no-gsm-04.80-parsing"],"who_is_affected":"Systems that link libosmocore and parse GSM 04.80 supplementary-service messages, typical in cellular network and telecom test software such as OsmoBTS-style or GSM stack deployments. Applications that do not process GSM 04.80 components are likely unaffected, but the sources do not confirm the exact exposed code path.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.00063,"input_tokens":3296,"output_tokens":600,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-104596':17A,20A '-2026':16A,19A '04.80':40B,77C '1.14.1':30B,67C 'allow':86C 'attack':50B,89C 'bound':5A,35B,72C 'buffer':60B 'compon':44B,81C 'contain':68C 'craft':53B 'cve':15A,18A 'data':14A 'gsm':8A,21B,39B,76C 'host':26B 'inform':64B,93C 'input':54B 'leak':13A 'libosmocor':1A,22B,28B,65C 'memori':57B 'obtain':62B,91C 'out-of-bound':2A,32B,69C 'outsid':58B 'packag':23B 'parser':12A,45B,82C 'read':6A,36B,56B,73C 'remot':49B,88C 'self':25B 'self-host':24B 'sensit':63B,92C 'servic':11A,43B,80C 'src/gsm/gsm0480.c':47B,84C 'supplementari':10A,42B,79C 'supplementary-servic':9A,41B,78C 'telecom':27B 'use':52B","nicknames":[],"mitigations":[],"who_affected":"Systems that link libosmocore and parse GSM 04.80 supplementary-service messages, typical in cellular network and telecom test software such as OsmoBTS-style or GSM stack deployments. Applications that do not process GSM 04.80 components are likely unaffected, but the sources do not confirm the exact exposed code path.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T20:17:37+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-104596","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104596","severity":null,"published_at":"2026-10-26T20:17:37+00:00","modified_at":"2026-10-26T20:17:37+00:00","first_seen_at":"2026-10-26T20:50:17+00:00","fetched_at":"2026-10-26T20:50:17+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}