CVE-2026-104598: Osmocom libosmo-sigtran vulnerability

Q: Who can exploit this issue?

A remote attacker can exploit the out-of-bounds read in the M3UA NOTIFY decoder. The provided data does not state any authentication or network-position requirements beyond remote reachability.

Q: Which deployments are affected?

libosmo-sigtran versions through 2.2.1 are affected. The issue is in M3UA NOTIFY message decoding, so exposure depends on whether the deployment processes M3UA traffic that an attacker can send.

Q: What is the potential impact?

Successful exploitation may allow disclosure of sensitive information through an out-of-bounds read.

Q: How can the issue be remediated?

Use the upstream fix referenced by commit b554131f2cbb20ca9a9cf51ca17d73f644eff1f8. The provided data does not identify a fixed release version.

Published Oct 26, 2026

Updated

libosmo-sigtran through 2.2.1 contains an out-of-bounds read in the M3UA NOTIFY decoder in src/m3ua.c. This allows a remote attacker to obtain sensitive information.

Affected Software

1 affected component

Osmocom libosmo-sigtran<=2.2.1

Event History

Oct 26, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

Who can exploit this issue?

A remote attacker can exploit the out-of-bounds read in the M3UA NOTIFY decoder. The provided data does not state any authentication or network-position requirements beyond remote reachability.

Which deployments are affected?

libosmo-sigtran versions through 2.2.1 are affected. The issue is in M3UA NOTIFY message decoding, so exposure depends on whether the deployment processes M3UA traffic that an attacker can send.

What is the potential impact?

Successful exploitation may allow disclosure of sensitive information through an out-of-bounds read.

How can the issue be remediated?

Use the upstream fix referenced by commit b554131f2cbb20ca9a9cf51ca17d73f644eff1f8. The provided data does not identify a fixed release version.

CVE-2026-104598: Osmocom libosmo-sigtran vulnerability

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

Which deployments are affected?

What is the potential impact?

How can the issue be remediated?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Which deployments are affected?

What is the potential impact?

How can the issue be remediated?