{"id":"CVE-2026-104593","aliases":["DEBIAN-CVE-2026-104593","EUVD-2026-110099","GHSA-hwh6-m764-wjg7","UBUNTU-CVE-2026-104593"],"status":"published","title":"osmo-msc through 1.15.0 contains a stack-based buffer overflow in decode_mme_name() in src/libmsc...","description":"osmo-msc through 1.15.0 contains a stack-based buffer overflow in decode_mme_name() in src/libmsc/sgs_iface.c. This allows a remote attacker to cause a denial of service.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00452,"percentile":0.39707,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-121"],"published":"2026-10-26T00:00:00Z","modified":"2026-11-04T02:47:11Z","fixes":[{"ecosystem":"Debian:14","package":"osmo-msc","fixed_in":["1.16.0+dfsg1-2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"osmo-msc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.12.0+dfsg1-1","1.12.0+dfsg1-2","1.13.0+dfsg1-1","1.13.0+dfsg1-2","1.13.0+dfsg1-3","1.16.0+dfsg1-1","1.16.0+dfsg1-2","1.9.0+dfsg1-2"]},{"source":"osv","ecosystem":"Debian:13","package":"osmo-msc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.13.0+dfsg1-2","1.13.0+dfsg1-3","1.16.0+dfsg1-1","1.16.0+dfsg1-2"]},{"source":"osv","ecosystem":"Debian:14","package":"osmo-msc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0+dfsg1-2"}]}],"versions":["1.13.0+dfsg1-2","1.13.0+dfsg1-3","1.16.0+dfsg1-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"osmo-msc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.0-3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"osmo-msc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.3+dfsg1-2","1.6.3+dfsg1-2build2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"osmo-msc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9.0+dfsg1-2","1.9.0+dfsg1-2build2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"osmo-msc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.13.0+dfsg1-2build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"osmo-msc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.13.0+dfsg1-2","1.13.0+dfsg1-2build1"]}],"references":[{"url":"https://osmocom.org/issues/7058","tags":["web","report"]},{"url":"https://github.com/osmocom/osmo-msc/commit/cd347bbe5392d8170ab87140b2bfdac683058b09","tags":["fix","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104593","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-hwh6-m764-wjg7"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/104xxx/CVE-2026-104593.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-104593","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-104593","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-104593","tags":["report"]},{"url":"https://github.com/cveproject/cvelistv5/tree/main/cves/2026/104xxx/cve-2026-104593.json","tags":["report"]},{"url":"https://nvd.nist.gov/vuln/detail/cve-2026-104593","tags":["report"]},{"url":"https://security-tracker.debian.org/tracker/cve-2026-104593","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-104593","description":"osmo-msc through 1.15.0 contains a stack-based buffer overflow in decode_mme_name() in src/libmsc/sgs_iface.c. This allows a remote attacker to cause a denial of service.","status":"published","published":"2026-10-26T00:00:00Z","modified":"2026-11-02T16:37:29.21Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T18:00:08.034842Z"}],"euvd":[{"id":"EUVD-2026-110099","description":"osmo-msc through 1.15.0 contains a stack-based buffer overflow in decode_mme_name() in src/libmsc/sgs_iface.c. This allows a remote attacker to cause a denial of service.","status":"published","published":"2026-10-26T00:00:00Z","modified":"2026-11-02T16:37:29Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T05:08:40.251173Z"}],"ghsa":[{"id":"GHSA-hwh6-m764-wjg7","title":"osmo-msc through 1.15.0 contains a stack-based buffer overflow in decode_mme_name() in src/libmsc...","description":"osmo-msc through 1.15.0 contains a stack-based buffer overflow in decode_mme_name() in src/libmsc/sgs_iface.c. This allows a remote attacker to cause a denial of service.","status":"published","published":"2026-10-26T21:36:08Z","modified":"2026-11-02T18:32:03Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T19:02:39.544035Z"}],"nvd":[{"id":"CVE-2026-104593","description":"osmo-msc through 1.15.0 contains a stack-based buffer overflow in decode_mme_name() in src/libmsc/sgs_iface.c. This allows a remote attacker to cause a denial of service.","status":"published","published":"2026-10-26T19:16:28.58Z","modified":"2026-11-02T17:17:31.89Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T20:51:42.820268Z"}],"osv":[{"id":"CVE-2026-104593","description":"osmo-msc through 1.15.0 contains a stack-based buffer overflow in decode_mme_name() in src/libmsc/sgs_iface.c. This allows a remote attacker to cause a denial of service.","status":"published","published":"2026-10-26T00:00:00Z","modified":"2026-11-11T13:05:32.480059647Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-11T03:22:04.464623Z"},{"id":"DEBIAN-CVE-2026-104593","description":"osmo-msc through 1.15.0 contains a stack-based buffer overflow in decode_mme_name() in src/libmsc/sgs_iface.c. This allows a remote attacker to cause a denial of service.","status":"published","published":"2026-10-26T19:16:28.58Z","modified":"2026-11-03T10:00:11.023999444Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T10:27:58.933618Z"},{"id":"UBUNTU-CVE-2026-104593","description":"osmo-msc through 1.15.0 contains a stack-based buffer overflow in decode_mme_name() in src/libmsc/sgs_iface.c. This allows a remote attacker to cause a denial of service.","status":"published","published":"2026-10-26T19:16:00Z","modified":"2026-11-04T03:30:17.854144316Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-04T03:56:39.110241Z"}]}}