CVE-2026-104594 in libosmocore
Summary
by MITRE • 10/26/2026
libosmocore through 1.14.1 contains out-of-bounds reads in the IPA CCM identity-tag parsers in src/gsm/ipa.c. This allows a remote attacker to obtain sensitive information.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/26/2026
The vulnerability identified within libosmocore versions up to and including 1.14.1 represents a critical memory safety issue located specifically within the implementation of the Inter-Operator Protocol (IPA) Common Control Message identity-tag parsers found in the source file src/gsm/ipa.c. This flaw is classified as an out-of-bounds read, which falls under the broader category of improper input validation and boundary checking errors commonly associated with CWE-125: Out-of-Bounds Read vulnerabilities. The root cause lies in the failure of the parsing logic to strictly verify that the length fields contained within incoming IPA messages are consistent with the actual size of the received buffer before attempting to access memory locations beyond the allocated limits.
From a technical perspective, when an application processes network data, it must ensure that any indices or lengths derived from that data do not exceed the bounds of the associated memory buffers. In this specific instance, the IPA CCM identity-tag parser does not adequately sanitize or validate the length parameters extracted from the protocol headers. Consequently, if a remote attacker crafts and transmits a maliciously formatted IPA message with an oversized identifier tag field, the application will attempt to read data from memory addresses that lie outside the intended buffer boundaries. This behavior is characteristic of CWE-125 vulnerabilities where the program reads beyond allocated memory regions, potentially accessing stack variables, heap metadata, or other sensitive process information depending on the allocation context and memory layout at runtime.
The operational impact of this vulnerability is significant due to its potential for remote exploitation without authentication in many deployment scenarios involving OpenBTS or similar GSM core network components that utilize libosmocore. By leveraging this out-of-bounds read condition, a remote attacker can achieve unauthorized information disclosure. The specific data exposed depends on the memory contents adjacent to the target buffer at the time of execution but may include cryptographic keys, session tokens, internal state variables, or other sensitive operational data stored in process memory. This capability effectively compromises the confidentiality integrity of the system and could serve as a precursor for more severe attacks such as remote code execution if combined with further exploitation techniques like heap spraying or information leakage to bypass security mitigations.
This vulnerability aligns with several entries in the MITRE ATT&CK framework, particularly those related to Collection via Network Capture or Exfiltration Over C2 Channel if the leaked data is transmitted out of band, but more directly it reflects Tactic 10: Discovery and Technique T1005: Data from Local System. The lack of proper bounds checking allows an adversary to probe system memory for valuable intelligence that aids in lateral movement or deeper penetration within a telecommunications infrastructure. Such vulnerabilities are particularly dangerous in telecom environments where the confidentiality of subscriber data and network signaling is paramount, as exposure can lead to privacy violations and regulatory non-compliance with standards such as GDPR or industry-specific security guidelines like 3GPP TS 33 series requirements for secure signaling transport.
To mitigate this vulnerability, organizations must immediately update libosmocore to a version newer than 1.14.1 where the parsing logic has been corrected to enforce strict length validation against buffer sizes before any memory access occurs. Developers should implement rigorous input sanitization practices that verify all protocol fields for consistency and bounds compliance prior to processing. Additionally, deploying runtime application self-protection mechanisms or using compilers with stack-smashing protection features can help detect such anomalies during execution. Network-level defenses such as deep packet inspection firewalls configured to validate IPA message structures against expected schemas may also provide a layer of defense by dropping malformed packets before they reach the vulnerable parser logic. Regular security audits and static analysis scanning focused on memory safety issues are recommended to identify similar patterns in legacy codebases that handle network protocol parsing.