CVE-2026-104594

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2026-104594", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2026-10-30T17:15:09.899Z", "dateReserved": "2026-10-02T00:00:00.000Z", "datePublished": "2026-10-26T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-10-26T18:57:32.666Z"}, "descriptions": [{"lang": "en", "value": "libosmocore through 1.14.1 contains out-of-bounds reads in the IPA CCM identity-tag parsers in src/gsm/ipa.c. This allows a remote attacker to obtain sensitive information."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://osmocom.org/issues/7050"}, {"url": "https://github.com/osmocom/libosmocore/commit/8ba652bca2f28ec05ff5979846199e2c46657633"}, {"url": "https://github.com/osmocom/libosmocore/commit/325ffb5204d7e1659ca2fec3b2f14c33b969ee71"}, {"url": "https://github.com/osmocom/libosmocore/commit/afd18bf00147e17c495fc909ac4583b3bf734d53"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-125", "lang": "en", "description": "CWE-125 Out-of-bounds Read"}]}], "references": [{"url": "https://osmocom.org/issues/7050", "tags": ["exploit"]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-10-30T16:28:49.166712Z", "id": "CVE-2026-104594", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-30T17:15:09.899Z"}}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-104594", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-30T16:28:49.166712Z"}}}], "references": [{"url": "https://osmocom.org/issues/7050", "tags": ["exploit"]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-30T16:29:12.635Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://osmocom.org/issues/7050"}, {"url": "https://github.com/osmocom/libosmocore/commit/8ba652bca2f28ec05ff5979846199e2c46657633"}, {"url": "https://github.com/osmocom/libosmocore/commit/325ffb5204d7e1659ca2fec3b2f14c33b969ee71"}, {"url": "https://github.com/osmocom/libosmocore/commit/afd18bf00147e17c495fc909ac4583b3bf734d53"}], "descriptions": [{"lang": "en", "value": "libosmocore through 1.14.1 contains out-of-bounds reads in the IPA CCM identity-tag parsers in src/gsm/ipa.c. This allows a remote attacker to obtain sensitive information."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-10-26T18:57:32.666Z"}}}, "cveMetadata": {"cveId": "CVE-2026-104594", "state": "PUBLISHED", "dateUpdated": "2026-10-30T17:15:09.899Z", "dateReserved": "2026-10-02T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-10-26T00:00:00.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "libosmocore through 1.14.1 contains out-of-bounds reads in the IPA CCM identity-tag parsers in src/gsm/ipa.c. This allows a remote attacker to obtain sensitive information."}], "id": "CVE-2026-104594", "lastModified": "2026-10-30T18:17:15.367", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-104594", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-30T16:28:49.166712Z", "version": "2.0.3"}}]}, "published": "2026-10-26T19:16:28.700", "references": [{"source": "cve@mitre.org", "url": "https://github.com/osmocom/libosmocore/commit/325ffb5204d7e1659ca2fec3b2f14c33b969ee71"}, {"source": "cve@mitre.org", "url": "https://github.com/osmocom/libosmocore/commit/8ba652bca2f28ec05ff5979846199e2c46657633"}, {"source": "cve@mitre.org", "url": "https://github.com/osmocom/libosmocore/commit/afd18bf00147e17c495fc909ac4583b3bf734d53"}, {"source": "cve@mitre.org", "url": "https://osmocom.org/issues/7050"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://osmocom.org/issues/7050"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "libosmocore: libosmocore: Information disclosure via out-of-bounds read in IPA CCM parser", "id": "2561026", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2561026"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "status": "draft"}, "cwe": "CWE-125", "details": ["libosmocore through 1.14.1 contains out-of-bounds reads in the IPA CCM identity-tag parsers in src/gsm/ipa.c. This allows a remote attacker to obtain sensitive information.", "A flaw was found in libosmocore. This issue allows a remote attacker to cause information disclosure via an out-of-bounds read vulnerability in the IPA CCM (Connection and Carrier Management) identity-tag parser. By sending specially crafted network messages, an attacker can trigger out-of-bounds memory access to retrieve sensitive data from system memory."], "name": "CVE-2026-104594", "public_date": "2026-10-26T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-104594\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-104594\nhttps://github.com/osmocom/libosmocore/commit/325ffb5204d7e1659ca2fec3b2f14c33b969ee71\nhttps://github.com/osmocom/libosmocore/commit/8ba652bca2f28ec05ff5979846199e2c46657633\nhttps://github.com/osmocom/libosmocore/commit/afd18bf00147e17c495fc909ac4583b3bf734d53\nhttps://osmocom.org/issues/7050"], "statement": "This vulnerability is rated as Moderate severity because, although exploitable remotely without authentication, the impact is strictly limited to information disclosure and does not allow service interruption or unauthorized data modification. Exploitation requires sending malformed protocol packets to applications that parse GSM multiplexing carrier management messages. Furthermore, libosmocore is not included or supported in Red Hat Enterprise Linux, restricting any potential exposure to community installations.", "threat_severity": "Moderate"}

{"created": "2026-10-26T21:00:10.152509+00:00", "updated": "2026-10-30T23:00:23.058910+00:00", "vendors": []}