CVE-2026-104596: Osmocom libosmocore vulnerability

Q: Which deployments are exposed to this issue?

Deployments using Osmocom libosmocore through version 1.14.1 are affected where the GSM 04.80 supplementary-service component parsers process remotely supplied data.

Q: What does an attacker need to do to exploit it?

An attacker needs to send input that reaches the GSM 04.80 supplementary-service component parsers in src/gsm/gsm0480.c. The reported impact is disclosure of sensitive information through out-of-bounds reads.

Q: How can I determine whether my environment is affected?

Check whether your software includes Osmocom libosmocore version 1.14.1 or earlier and whether it uses the GSM 04.80 supplementary-service component parsing functionality in src/gsm/gsm0480.c.

Published Oct 26, 2026

Updated

libosmocore through 1.14.1 contains out-of-bounds reads in the GSM 04.80 supplementary-service component parsers in src/gsm/gsm0480.c. This allows a remote attacker to obtain sensitive information.

Affected Software

1 affected component

Osmocom libosmocore<=1.14.1

Event History

Oct 26, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using Osmocom libosmocore through version 1.14.1 are affected where the GSM 04.80 supplementary-service component parsers process remotely supplied data.

What does an attacker need to do to exploit it?

An attacker needs to send input that reaches the GSM 04.80 supplementary-service component parsers in src/gsm/gsm0480.c. The reported impact is disclosure of sensitive information through out-of-bounds reads.

How can I determine whether my environment is affected?

Check whether your software includes Osmocom libosmocore version 1.14.1 or earlier and whether it uses the GSM 04.80 supplementary-service component parsing functionality in src/gsm/gsm0480.c.

CVE-2026-104596: Osmocom libosmocore vulnerability

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to do to exploit it?

How can I determine whether my environment is affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to do to exploit it?

How can I determine whether my environment is affected?