CVE-2026-104593 Osmocom CVE debrief

Who should care

Defenders responsible for systems or networks utilizing osmo-msc versions up to 1.15.0 should assess exposure and prioritize patching or mitigation efforts to prevent potential denial-of-service conditions.

Why it matters

CVE-2026-104593 is a stack-based buffer overflow vulnerability in osmo-msc through version 1.15.0, allowing remote attackers to cause a denial of service. Defenders should verify and apply patches, monitor for exploitation attempts, and update incident response plans to address potential service disruptions.

• Remote denial of service via buffer overflow requires verification of osmo-msc versions and potential service disruption.

Technical summary

The osmo-msc project, up to version 1.15.0, contains a stack-based buffer overflow vulnerability in the decode_mme_name() function. This function is located in the src/libmsc/sgs_iface.c file. The vulnerability can be exploited remotely to cause a denial of service.

Defensive priority

Defenders should prioritize verifying and applying patches for osmo-msc versions up to 1.15.0, as the vulnerability can lead to a denial of service via a stack-based buffer overflow.

Recommended defensive actions

• Verify osmo-msc versions in use and check for patches or updates to address the buffer overflow vulnerability.
• Implement network monitoring to detect potential exploitation attempts targeting this vulnerability.
• Review and update incident response plans to include procedures for handling potential denials of service.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its existence in osmo-msc through version 1.15.0 and the potential for a remote denial of service. However, specific details about exploitation or affected systems are limited.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.