UBUNTU-CVE-2026-104597: Medium severity ubuntu/libosmocore vulnerability

Published Oct 26, 2026

Updated

libosmocore through 1.14.1 contains an out-of-bounds read in iuuprxinitialization() in src/gsm/iuup.c. This allows a remote attacker to obtain sensitive information.

Affected Software

7 affected components

ubuntu/libosmocore*

Event History

Oct 26, 2026

CVE Published

via OSV·08:17 PM

Data Sourced

via OSV·08:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What component must process attacker-controlled input for this issue to be exploitable?

The vulnerable code is iuup_rx_initialization() in src/gsm/iuup.c. Exploitation requires a remote attacker to supply input that reaches this IuUP initialization-processing function.

What is the potential impact of successful exploitation?

The out-of-bounds read may allow a remote attacker to obtain sensitive information from the affected process.

Which versions are identified as affected?

The issue is reported in libosmocore through version 1.14.1. The provided data does not identify a fixed version.

UBUNTU-CVE-2026-104597: Medium severity ubuntu/libosmocore vulnerability

Affected Software

Event History

Frequently Asked Questions

What component must process attacker-controlled input for this issue to be exploitable?

What is the potential impact of successful exploitation?

Which versions are identified as affected?

Company

Resources

Contact

Frequently Asked Questions

What component must process attacker-controlled input for this issue to be exploitable?

What is the potential impact of successful exploitation?

Which versions are identified as affected?