{"id":"CVE-2026-104596","aliases":["DEBIAN-CVE-2026-104596","EUVD-2026-110097","GHSA-539p-x22q-cp96","UBUNTU-CVE-2026-104596"],"status":"published","title":"libosmocore through 1.14.1 contains out-of-bounds reads in the GSM 04.80 supplementary-service...","description":"libosmocore through 1.14.1 contains out-of-bounds reads in the GSM 04.80 supplementary-service component parsers in src/gsm/gsm0480.c. This allows a remote attacker to obtain sensitive information.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00389,"percentile":0.33552,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2026-10-26T00:00:00Z","modified":"2026-11-11T02:48:40Z","fixes":[{"ecosystem":"Debian:14","package":"libosmocore","fixed_in":["1.14.2-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"libosmocore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10.0-1","1.10.0-2","1.11.0-1","1.11.0-2","1.14.0-1","1.14.2-1","1.7.0-3","1.7.0-3.1","1.7.0-3.1~exp1","1.9.2-1"]},{"source":"osv","ecosystem":"Debian:13","package":"libosmocore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.11.0-2","1.14.0-1","1.14.2-1"]},{"source":"osv","ecosystem":"Debian:14","package":"libosmocore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.2-1"}]}],"versions":["1.11.0-2","1.14.0-1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libosmocore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.0-4"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libosmocore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.0-7"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libosmocore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.12.1-3","0.12.1-3ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libosmocore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.2-3","1.6.0-3","1.6.0-3build1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libosmocore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.0-3","1.7.0-3.1build1","1.7.0-3.1build2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libosmocore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.11.0-2build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libosmocore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.11.0-2","1.11.0-2build1"]}],"references":[{"url":"https://osmocom.org/issues/7051","tags":["web","report"]},{"url":"https://github.com/osmocom/libosmocore/commit/b6c8c72c0c063ab2f293c5226472341c432454c2","tags":["fix","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104596","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-539p-x22q-cp96"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/104xxx/CVE-2026-104596.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-104596","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-104596","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-104596","tags":["report"]},{"url":"https://github.com/cveproject/cvelistv5/tree/main/cves/2026/104xxx/cve-2026-104596.json","tags":["report"]},{"url":"https://nvd.nist.gov/vuln/detail/cve-2026-104596","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-104596","description":"libosmocore through 1.14.1 contains out-of-bounds reads in the GSM 04.80 supplementary-service component parsers in src/gsm/gsm0480.c. This allows a remote attacker to obtain sensitive information.","status":"published","published":"2026-10-26T00:00:00Z","modified":"2026-10-29T20:19:01.668Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:20:09.448255Z"}],"euvd":[{"id":"EUVD-2026-110097","description":"libosmocore through 1.14.1 contains out-of-bounds reads in the GSM 04.80 supplementary-service component parsers in src/gsm/gsm0480.c. This allows a remote attacker to obtain sensitive information.","status":"published","published":"2026-10-26T00:00:00Z","modified":"2026-10-29T20:19:01Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T16:59:14.591479Z"}],"ghsa":[{"id":"GHSA-539p-x22q-cp96","title":"libosmocore through 1.14.1 contains out-of-bounds reads in the GSM 04.80 supplementary-service...","description":"libosmocore through 1.14.1 contains out-of-bounds reads in the GSM 04.80 supplementary-service component parsers in src/gsm/gsm0480.c. This allows a remote attacker to obtain sensitive information.","status":"published","published":"2026-10-26T21:36:08Z","modified":"2026-10-29T21:32:21Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:14:41.240878Z"}],"nvd":[{"id":"CVE-2026-104596","description":"libosmocore through 1.14.1 contains out-of-bounds reads in the GSM 04.80 supplementary-service component parsers in src/gsm/gsm0480.c. This allows a remote attacker to obtain sensitive information.","status":"published","published":"2026-10-26T20:17:37.573Z","modified":"2026-10-29T21:17:08.973Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:13:03.452847Z"}],"osv":[{"id":"CVE-2026-104596","description":"libosmocore through 1.14.1 contains out-of-bounds reads in the GSM 04.80 supplementary-service component parsers in src/gsm/gsm0480.c. This allows a remote attacker to obtain sensitive information.","status":"published","published":"2026-10-26T00:00:00Z","modified":"2026-11-11T10:47:22.900037639Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-11T03:22:04.464623Z"},{"id":"DEBIAN-CVE-2026-104596","description":"libosmocore through 1.14.1 contains out-of-bounds reads in the GSM 04.80 supplementary-service component parsers in src/gsm/gsm0480.c. This allows a remote attacker to obtain sensitive information.","status":"published","published":"2026-10-26T20:17:37.573Z","modified":"2026-11-02T00:00:06.515827267Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:48.903138Z"},{"id":"UBUNTU-CVE-2026-104596","description":"libosmocore through 1.14.1 contains out-of-bounds reads in the GSM 04.80 supplementary-service component parsers in src/gsm/gsm0480.c. This allows a remote attacker to obtain sensitive information.","status":"published","published":"2026-10-26T20:17:00Z","modified":"2026-10-31T03:30:04.466274902Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T16:55:59.130573Z"}]}}