CVE-2026-104597 osmocom CVE debrief

Who should care

Defenders responsible for systems using libosmocore, especially those handling sensitive information, should assess exposure and prioritize patching.

Why it matters

CVE-2026-104597 is a vulnerability in libosmocore that allows a remote attacker to obtain sensitive information. Defenders should prioritize verifying and applying patches, reviewing system configurations, and monitoring for potential exploitation attempts.

• Potential exposure of sensitive information
• Need for verification of affected versions and system configurations
• Priority for patching and updating libosmocore

Technical summary

The vulnerability is caused by an out-of-bounds read in iuup_rx_initialization() in src/gsm/iuup.c, which allows a remote attacker to obtain sensitive information. This issue is particularly concerning for systems handling sensitive information, as it could lead to exposure of such data. The vulnerability is confined to libosmocore versions up to 1.14.1, and defenders should prioritize verifying and applying patches.

Defensive priority

Defenders should prioritize verifying and applying patches for libosmocore, especially in systems handling sensitive information.

Recommended defensive actions

• Verify and apply patches for libosmocore
• Review system configurations and inventory for potential exposure
• Monitor for potential exploitation attempts

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further verification is required to determine the affected versions and potential impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.