7.5
HighCVSS 3.1 · from CISA
CVE-2026-104594
libosmocore through 1.14.1 contains out-of-bounds reads in the IPA CCM identity-tag parsers in src/gsm/ipa.c.
FixNo fix listed yet.
PublishedOct 26, 00:00 · mitre
Scored7.5 · CISA
Exploit code publicNone known · checked 22:18 UTC
ExploitedNone known · CISA KEV checked 22:30 UTC
What we know
No known exploitation. CISA KEV, checked 22:30 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 22:18 UTC.
An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.
A successful attack can read data. CVSS impact.
Description
libosmocore through 1.14.1 contains out-of-bounds reads in the IPA CCM identity-tag parsers in src/gsm/ipa.c. This allows a remote attacker to obtain sensitive information.
From mitre
Affected and fixed versions
ProductAffectedFixed inUnknownn/a–
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known