UBUNTU-CVE-2026-104591: Buffer Overflow

Published Oct 26, 2026

Updated

libosmocore through 1.14.1 contains a buffer overflow in osmoiuupcomputepayloadcrc() in src/gsm/iuup.c. This allows a remote attacker to cause a denial of service.

Affected Software

7 affected components

ubuntu/libosmocore*

Event History

Oct 26, 2026

CVE Published

via OSV·07:16 PM

Data Sourced

via OSV·07:16 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

The issue is described as remotely exploitable. The available information does not specify any authentication requirement, network exposure conditions, or the exact input path that reaches the affected function.

What is the expected impact of successful exploitation?

Successful exploitation can cause a denial of service through a buffer overflow in osmo_iuup_compute_payload_crc(). The provided data does not indicate code execution, privilege escalation, or data disclosure.

Which versions should be treated as potentially affected?

libosmocore versions through 1.14.1 are identified as containing the flaw. The provided information does not list an upstream fixed version or Ubuntu package update version.

How can an organization determine whether it is affected?

Identify systems running the Ubuntu libosmocore package and determine whether their installed libosmocore version is 1.14.1 or earlier. The supplied data does not provide a detection signature, exploit indicator, or affected configuration details.

UBUNTU-CVE-2026-104591: Buffer Overflow

Affected Software

Event History

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

What is the expected impact of successful exploitation?

Which versions should be treated as potentially affected?

How can an organization determine whether it is affected?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

What is the expected impact of successful exploitation?

Which versions should be treated as potentially affected?

How can an organization determine whether it is affected?