{"id":"CVE-2026-104597","kind":"vulnerability","aliases":["CVE-2026-104597"],"related":[],"title":"libosmocore: out-of-bounds read in IuUP receive lets remote attackers leak memory","description":"libosmocore through 1.14.1 contains an out-of-bounds read in iuup_rx_initialization() in src/gsm/iuup.c. This allows a remote attacker to obtain sensitive information.","summary":"libosmocore through 1.14.1 has an out-of-bounds read in iuup_rx_initialization() in src/gsm/iuup.c. A remote attacker can use it to obtain sensitive information from process memory.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["libosmocore","osmocom","package","self-hosted","telecom"],"not_affected_if":["no-libosmocore"],"how_to_check":"- Check the installed libosmocore version with `pkg-config --modversion libosmocore` and compare it to `1.14.1`\n- Look for `iuup.c` or `libosmocore` in the dependency tree of any cellular or GSM tooling you run (unknown otherwise)","fix":"- Upgrade libosmocore past `1.14.1` once a fixed release is published (unknown whether one exists yet)","status":"open","published_at":"2026-10-26T20:17:37+00:00","first_seen_at":"2026-10-26T20:50:17+00:00","triaged_at":"2026-10-26T20:52:02+00:00","updated_at":"2026-10-26T20:52:02+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-10-26T20:52:02Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade libosmocore past `1.14.1` once a fixed release is published (unknown whether one exists yet)","reach":"network","title":"libosmocore: out-of-bounds read in IuUP receive lets remote attackers leak memory","impact":"medium","summary":"libosmocore through 1.14.1 has an out-of-bounds read in iuup_rx_initialization() in src/gsm/iuup.c. A remote attacker can use it to obtain sensitive information from process memory.","category":"package","nicknames":[],"who_cares":["libosmocore","osmocom","telecom","self-hosted"],"confidence":0.4,"needs_auth":"unknown","worst_case":"Remote attacker reads sensitive process memory from the service","analyst_note":"Check the NVD entry and the libosmocore upstream repository for the fix version and whether IuUP is enabled by default.","how_to_check":"- Check the installed libosmocore version with `pkg-config --modversion libosmocore` and compare it to `1.14.1`\n- Look for `iuup.c` or `libosmocore` in the dependency tree of any cellular or GSM tooling you run (unknown otherwise)","needs_analyst":true,"not_affected_if":["no-libosmocore"],"who_is_affected":"Teams that run libosmocore in GSM or cellular core-network software, such as Osmocom components, that handles Iu user-plane traffic. The sources do not say which deployments reach the vulnerable IuUP initialization path by default. Teams that do not run libosmocore can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000616,"input_tokens":3288,"output_tokens":574,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-104597':17A,20A '-2026':16A,19A '1.14.1':30B,59C 'allow':74C 'attack':12A,46B,77C 'bound':5A,36B,65C 'contain':60C 'cve':15A,18A 'host':26B 'inform':53B,81C 'initi':41B,70C 'iuup':8A,39B,68C 'leak':13A 'let':10A 'libosmocor':1A,21B,28B,57C 'memori':14A,56B 'obtain':51B,79C 'osmocom':22B 'out-of-bound':2A,33B,62C 'packag':23B 'process':55B 'read':6A,37B,66C 'receiv':9A 'remot':11A,45B,76C 'rx':40B,69C 'self':25B 'self-host':24B 'sensit':52B,80C 'src/gsm/iuup.c':43B,72C 'telecom':27B 'use':48B","nicknames":[],"mitigations":[],"who_affected":"Teams that run libosmocore in GSM or cellular core-network software, such as Osmocom components, that handles Iu user-plane traffic. The sources do not say which deployments reach the vulnerable IuUP initialization path by default. Teams that do not run libosmocore can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T20:17:37+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-104597","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104597","severity":null,"published_at":"2026-10-26T20:17:37+00:00","modified_at":"2026-10-26T20:17:37+00:00","first_seen_at":"2026-10-26T20:50:17+00:00","fetched_at":"2026-10-26T20:50:17+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}