CVE-2026-75895: Out of bounds read at smpp34_unpack()

Q: Which deployments should be prioritized for review?

Prioritize deployments using libsmpp35 versions 0.1.0 through 1.8.0 that process SMPP PDUs supplied by untrusted or attacker-controlled sources.

Q: What does an attacker need to provide to trigger the issue?

The attacker needs to supply a crafted SMPP PDU that reaches the smpp34_unpack() function. The reported outcome is an out-of-bounds read leading to memory corruption.

Published Sep 18, 2026

Updated

In libsmpp35 from 0.1.0 through 1.8.0 out of bound read issue was found in the at smpp34unpack() function via attacker controlled SMPP PDUs, leading to memory corruption.

Affected Software

1 affected component

libsmpp35>=0.1.0<=1.8.0

Event History

Sep 18, 2026

CVE Published

via MITRE·07:01 PM

Data Sourced

via MITRE·07:01 PM

DescriptionWeakness

Frequently Asked Questions

Which deployments should be prioritized for review?

Prioritize deployments using libsmpp35 versions 0.1.0 through 1.8.0 that process SMPP PDUs supplied by untrusted or attacker-controlled sources.

What does an attacker need to provide to trigger the issue?

The attacker needs to supply a crafted SMPP PDU that reaches the smpp34_unpack() function. The reported outcome is an out-of-bounds read leading to memory corruption.