Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-104592: libosmocore may crash from crafted CBSP messages

CVE-2026-104592 · published 10 days ago

Summary

The libosmocore library (up to version 1.14.1) can read beyond the end of a data buffer when processing certain CBSP WRITE-REPLACE messages. This could let an external attacker trigger a crash that stops the service from working. Upgrade to a newer version of libosmocore or apply the provided patch to fix the issue.

What to do

Update debian libosmocore to version 1.14.2-1.

Affected software

Ecosystem	Vendor	Product	Affected versions
Debian:12	debian	libosmocore	All versions
Debian:14	debian	libosmocore	< 1.14.2-1 Fix: upgrade to 1.14.2-1
Ubuntu:16.04:LTS	canonical	libosmocore	All versions

Original advisory text

libosmocore through 1.14.1 contains an out-of-bounds read in the CBSP WRITE-REPLACE decoder in src/gsm/cbsp.c. This allows a remote attacker to cause a denial of service.

References

https://ubuntu.com/security/CVE-2026-104592 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-104592 Third Party Advisory
https://github.com/cveproject/cvelistv5/tree/main/cves/2026/104xxx/cve-2026-1045... Third Party Advisory
https://nvd.nist.gov/vuln/detail/cve-2026-104592 Third Party Advisory
https://security-tracker.debian.org/tracker/cve-2026-104592 Third Party Advisory
https://gerrit.osmocom.org/c/libosmocore/+/43215 URL
https://osmocom.org/issues/7053 URL
https://github.com/osmocom/libosmocore/commit/1659b5874223934d5586e3e96b7d59f653... Patch
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/104xxx/CVE-2026-1045... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-104592 Vendor Advisory
https://security-tracker.debian.org/tracker/CVE-2026-104592 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

6.5 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-125Out-of-bounds Read

Timeline

Published26 Oct 2026

Updated1 Nov 2026

First seen26 Oct 2026

Sources

CVE-2026-104592 · NVD

CVE-2026-104592 · OSV

UBUNTU-CVE-2026-104592 · OSV

DEBIAN-CVE-2026-104592 · OSV

CVE-2026-104592 · MITRE

Track software like this

Free during beta