CVE-2026-104592 in libosmocore
Summary
by MITRE • 10/26/2026
libosmocore through 1.14.1 contains an out-of-bounds read in the CBSP WRITE-REPLACE decoder in src/gsm/cbsp.c. This allows a remote attacker to cause a denial of service.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/26/2026
The vulnerability identified within libosmocore versions up to and including 1.14.1 represents a critical security flaw located specifically in the Control Block Signaling Protocol, or CBSP, implementation found in the source file src/gsm/cbsp.c. This library serves as a foundational component for OpenBTS and other GSM network infrastructure software, handling low-level signaling protocols essential for mobile communication networks. The specific defect is an out-of-bounds read that occurs during the decoding process of the WRITE-REPLACE message type within the CBSP protocol stack. An attacker capable of injecting or manipulating network traffic directed at a system running this vulnerable version can exploit this flaw to trigger unauthorized memory access operations, leading directly to service disruption.
From a technical perspective, the root cause lies in insufficient validation of input data lengths relative to buffer boundaries during the parsing phase of the CBSP WRITE-REPLACE decoder. When processing incoming messages, the software fails to adequately verify that the payload size does not exceed the allocated memory space before attempting to read or process specific fields. This lack of boundary checking allows a remote attacker to craft maliciously formatted packets with oversized payloads or malformed headers. Upon receipt and subsequent decoding by the vulnerable function, the application attempts to access memory locations beyond the intended buffer limits. In many implementations, such out-of-bounds reads result in immediate segmentation faults or core dumps due to illegal memory access violations, although depending on compiler optimizations and runtime environments, it could potentially leak sensitive information from adjacent memory regions before crashing.
The operational impact of this vulnerability is primarily characterized by a denial of service condition affecting the GSM network infrastructure component running libosmocore. Since CBSP messages are integral to maintaining signaling connections between base stations and core network elements, any crash in the decoder process can disrupt active sessions or prevent new ones from being established. For operators relying on OpenBTS for private mobile networks or testing environments, this means that a single crafted packet could bring down critical signaling services, leading to loss of connectivity for connected user equipment. The severity is heightened by the fact that CBSP operates over reliable transport protocols like TCP, which may allow attackers to establish persistent connections and repeatedly send malformed packets to ensure service instability remains continuous until the process is manually restarted or patched.
This vulnerability aligns with Common Weakness Enumeration identifier CWE-125, which describes Out-of-bounds Read vulnerabilities where software reads data past the end of a buffer. In terms of offensive security frameworks, this exploit scenario maps closely to MITRE ATT&CK technique T1498, Network Denial of Service, specifically involving resource exhaustion through application crashes rather than bandwidth saturation. The attack vector is classified as remote with low complexity because it requires only network access and the ability to send a single malformed packet to trigger the flaw, without needing authentication or complex setup procedures in many deployment scenarios where CBSP ports are exposed for inter-node communication.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. The most effective solution is to upgrade libosmocore to version 1.15.0 or later, where the developers have addressed this specific boundary check issue in the CBSP decoder logic. For environments unable to immediately patch due to dependency constraints, network-level filtering should be implemented to restrict access to CBSP ports exclusively from trusted internal IP ranges associated with legitimate base station controllers and core network elements. Additionally, deploying intrusion detection systems configured to identify anomalous packet sizes or malformed GSM signaling structures can help mitigate the risk by dropping suspicious traffic before it reaches the vulnerable application layer. Regular code audits focusing on input validation in protocol parsers are also recommended to prevent similar out-of-bounds errors across other components of the telecommunication software stack.