How do I check whether I am affected by CVE-2026-104598?

- Check the installed libosmo-sigtran version with `pkg-config --modversion libosmo-sigtran` or the package manager, and compare it to `2.2.1` - unknown whether other check methods are needed; the sources do not say

What is the fix for CVE-2026-104598?

- Move libosmo-sigtran past `2.2.1` once a fixed release is published; the sources do not name a fixed version - unknown whether a patch or commit exists; the sources do not say

Who is not affected by CVE-2026-104598?

Not affected if: no-m3ua-listener.

Live › vulnerability › CVE-2026-104598

Go to dashboard

unknownOther

libosmo-sigtran: out-of-bounds read in M3UA NOTIFY decoder leaks data

libosmo-sigtran through 2.2.1 has an out-of-bounds read in the M3UA NOTIFY message decoder in src/m3ua.c. A remote attacker sending a crafted NOTIFY message can read memory beyond the buffer and obtain sensitive information.

Summary written from the sources below. Check the originals before acting.

Known so far

3/6

unknown

no CVSS yet; severity from the sources

known so far3 of 6

missing: versions, primary source, exploitation

First public: Oct 26, 2026 UTC
Last modified: Oct 26, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-26 20:50 UTC. All times on this page are UTC.

Why it is unknown, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Not known from the sources.
Needs a special setup: Not known from the sources.
Reachable from: network.
Worst case: Remote attacker reads sensitive memory from the decoder process.
CVSS said: No score. The facts above say low; we keep the sources' unknown until an analyst looks.

Who is affected

Systems running libosmo-sigtran through 2.2.1 that accept M3UA traffic from remote peers are exposed, since the flaw is in the decoder for incoming NOTIFY messages. Teams that do not run libosmo-sigtran or the M3UA stack, or that do not expose the SIGTRAN port to untrusted networks, can likely skip it; the sources do not say more.

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2026-104598

Go to dashboard

unknownOther

libosmo-sigtran: out-of-bounds read in M3UA NOTIFY decoder leaks data

Summary written from the sources below. Check the originals before acting.

Known so far

3/6

unknown

no CVSS yet; severity from the sources

known so far3 of 6

missing: versions, primary source, exploitation

First public: Oct 26, 2026 UTC
Last modified: Oct 26, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-26 20:50 UTC. All times on this page are UTC.

Why it is unknown, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Not known from the sources.
Needs a special setup: Not known from the sources.
Reachable from: network.
Worst case: Remote attacker reads sensitive memory from the decoder process.
CVSS said: No score. The facts above say low; we keep the sources' unknown until an analyst looks.

Who is affected

Know the next one before it finds you.

Add to Slack

libosmo-sigtran: out-of-bounds read in M3UA NOTIFY decoder leaks data

Why it is unknown, and not just CVSS

Who is affected

Know the next one before it finds you.

libosmo-sigtran: out-of-bounds read in M3UA NOTIFY decoder leaks data

Why it is unknown, and not just CVSS

Who is affected

Know the next one before it finds you.

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources