CVE-2026-104596
Received Received - Intake

Out-of-Bounds Read in libosmocore GSM 04.80 Parsers

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: MITRE

Description
libosmocore through 1.14.1 contains out-of-bounds reads in the GSM 04.80 supplementary-service component parsers in src/gsm/gsm0480.c. This allows a remote attacker to obtain sensitive information.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-104596
EUVD
EUVD-2026-110097

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
n/a n/a n/a

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

libosmocore through version 1.14.1 has out-of-bounds read vulnerabilities in the GSM 04.80 supplementary-service component parsers. These vulnerabilities occur in the functions parse_ss_invoke() and parse_ss_return_result() due to insufficient boundary checks, allowing reads beyond allocated memory buffers.

Impact Analysis

A remote attacker could exploit these vulnerabilities to obtain sensitive information by reading memory outside intended buffers. This may lead to unauthorized data exposure or potential system compromise depending on the context of the affected application.

Mitigation Strategies

Update libosmocore to version 1.14.1 or later to address the out-of-bounds read vulnerabilities in the GSM 04.80 protocol parsers.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-104596. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart