CVE-2026-104594 Osmocom CVE debrief

Who should care

Defenders responsible for libosmocore installations, security teams, and developers using libosmocore should assess exposure and prioritize patching. The vulnerability affects libosmocore installations, and it is essential to verify and patch vulnerable installations to prevent potential information disclosure. Defenders should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Why it matters

CVE-2026-104594 is a vulnerability in libosmocore that allows remote attackers to obtain sensitive information. Defenders should prioritize verifying and patching vulnerable installations to prevent potential information disclosure.

• Potential information disclosure to remote attackers
• Need to verify and patch vulnerable libosmocore installations
• Possible impact on confidentiality

Technical summary

The vulnerability is caused by out-of-bounds reads in the IPA CCM identity-tag parsers in src/gsm/ipa.c of libosmocore through 1.14.1. This allows a remote attacker to obtain sensitive information. The vulnerability affects libosmocore installations, and defenders should assess exposure and prioritize patching. The IPA CCM identity-tag parsers in src/gsm/ipa.c are impacted, and the vulnerability allows remote attackers to obtain sensitive information. Defenders should prioritize verifying and patching vulnerable libosmocore installations to prevent potential information disclosure.

Defensive priority

Defenders should prioritize verifying and patching vulnerable libosmocore installations to prevent potential information disclosure.

Recommended defensive actions

• Verify libosmocore version and check for patch availability
• Apply patches or updates to vulnerable libosmocore installations
• Monitor for potential information disclosure attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but do not specify versions, exploitation, impact, or remediation beyond patching. The vulnerability is caused by out-of-bounds reads in the IPA CCM identity-tag parsers in src/gsm/ipa.c of libosmocore through 1.14.1. This allows a remote attacker to obtain sensitive information. Defenders should prioritize verifying and patching vulnerable libosmocore installations to prevent potential information disclosure. The vulnerability affects libosmocore installations, and it

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.