{"id":"CVE-2026-104598","kind":"vulnerability","aliases":["CVE-2026-104598"],"related":[],"title":"libosmo-sigtran: out-of-bounds read in M3UA NOTIFY decoder leaks data","description":"libosmo-sigtran through 2.2.1 contains an out-of-bounds read in the M3UA NOTIFY decoder in src/m3ua.c. This allows a remote attacker to obtain sensitive information.","summary":"libosmo-sigtran through 2.2.1 has an out-of-bounds read in the M3UA NOTIFY message decoder in src/m3ua.c. A remote attacker sending a crafted NOTIFY message can read memory beyond the buffer and obtain sensitive information.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["osmocom","other","self-hosted","sigtran","telecom"],"not_affected_if":["no-m3ua-listener"],"how_to_check":"- Check the installed libosmo-sigtran version with `pkg-config --modversion libosmo-sigtran` or the package manager, and compare it to `2.2.1`\n- unknown whether other check methods are needed; the sources do not say","fix":"- Move libosmo-sigtran past `2.2.1` once a fixed release is published; the sources do not name a fixed version\n- unknown whether a patch or commit exists; the sources do not say","status":"open","published_at":"2026-10-26T20:17:37+00:00","first_seen_at":"2026-10-26T20:50:17+00:00","triaged_at":"2026-10-26T20:52:01+00:00","updated_at":"2026-10-26T20:52:01+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-10-26T20:52:01Z","model":"claude-haiku-5-5","output":{"fix":"- Move libosmo-sigtran past `2.2.1` once a fixed release is published; the sources do not name a fixed version\n- unknown whether a patch or commit exists; the sources do not say","reach":"network","title":"libosmo-sigtran: out-of-bounds read in M3UA NOTIFY decoder leaks data","impact":"low","summary":"libosmo-sigtran through 2.2.1 has an out-of-bounds read in the M3UA NOTIFY message decoder in src/m3ua.c. A remote attacker sending a crafted NOTIFY message can read memory beyond the buffer and obtain sensitive information.","category":"other","nicknames":[],"who_cares":["telecom","sigtran","osmocom","self-hosted"],"confidence":0.4,"needs_auth":"unknown","worst_case":"Remote attacker reads sensitive memory from the decoder process","analyst_note":"Check the NVD entry and the upstream osmocom project for the fixed version, whether M3UA listening is default, and what memory is exposed.","how_to_check":"- Check the installed libosmo-sigtran version with `pkg-config --modversion libosmo-sigtran` or the package manager, and compare it to `2.2.1`\n- unknown whether other check methods are needed; the sources do not say","needs_analyst":true,"not_affected_if":["no-m3ua-listener"],"who_is_affected":"Systems running libosmo-sigtran through 2.2.1 that accept M3UA traffic from remote peers are exposed, since the flaw is in the decoder for incoming NOTIFY messages. Teams that do not run libosmo-sigtran or the M3UA stack, or that do not expose the SIGTRAN port to untrusted networks, can likely skip it; the sources do not say more.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000655,"input_tokens":3296,"output_tokens":651,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-104598':17A,20A '-2026':16A,19A '2.2.1':32B,70C 'allow':86C 'attack':50B,89C 'beyond':59B 'bound':7A,38B,76C 'buffer':61B 'contain':71C 'craft':53B 'cve':15A,18A 'data':14A 'decod':12A,45B,82C 'host':25B 'inform':65B,93C 'leak':13A 'libosmo':2A,29B,67C 'libosmo-sigtran':1A,28B,66C 'm3ua':10A,42B,80C 'memori':58B 'messag':44B,55B 'notifi':11A,43B,54B,81C 'obtain':63B,91C 'osmocom':21B 'out-of-bound':4A,35B,73C 'read':8A,39B,57B,77C 'remot':49B,88C 'self':24B 'self-host':23B 'send':51B 'sensit':64B,92C 'sigtran':3A,26B,30B,68C 'src/m3ua.c':47B,84C 'telecom':27B","nicknames":[],"mitigations":[],"who_affected":"Systems running libosmo-sigtran through 2.2.1 that accept M3UA traffic from remote peers are exposed, since the flaw is in the decoder for incoming NOTIFY messages. Teams that do not run libosmo-sigtran or the M3UA stack, or that do not expose the SIGTRAN port to untrusted networks, can likely skip it; the sources do not say more.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T20:17:37+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-104598","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104598","severity":null,"published_at":"2026-10-26T20:17:37+00:00","modified_at":"2026-10-26T20:17:37+00:00","first_seen_at":"2026-10-26T20:50:17+00:00","fetched_at":"2026-10-26T20:50:17+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}