CVE-2026-104596 in libosmocore
Summary
by MITRE • 10/26/2026
libosmocore through 1.14.1 contains out-of-bounds reads in the GSM 04.80 supplementary-service component parsers in src/gsm/gsm0480.c. This allows a remote attacker to obtain sensitive information.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/26/2026
The vulnerability identified within libosmocore versions through 1.14.1 represents a critical security flaw located specifically within the GSM 04.80 supplementary-service component parsers, implemented in the source file src/gsm/gsm0480.c. This library serves as a foundational open-source implementation of mobile network protocols, widely utilized by telecommunications operators and equipment manufacturers to handle signaling traffic between base stations and core network elements. The specific defect involves an out-of-bounds read condition that occurs when the parser processes malformed or specially crafted GSM 04.80 messages. In these scenarios, the application fails to adequately validate the length fields or boundaries of incoming data structures before attempting to access memory locations associated with supplementary service parameters. This lack of rigorous bounds checking allows the program to read beyond the allocated buffer limits, potentially exposing adjacent memory contents that were not intended for disclosure in this context.
From a technical perspective, out-of-bounds reads are classified under CWE-125, which denotes an issue where software reads data past the end or before the beginning of the intended buffer. In the specific case of GSM 04.80 parsing, the supplementary services such as call forwarding, caller ID restriction, and three-way calling involve complex message structures with variable-length fields. If a remote attacker constructs a signaling packet that contains inconsistent length indicators or truncated data segments, the parser may attempt to dereference memory addresses outside the valid range of the input buffer. While out-of-bounds reads are generally considered less severe than write vulnerabilities because they do not directly allow for arbitrary code execution, they remain highly dangerous in network-facing services due to their potential to leak sensitive information. The attacker can exploit this flaw by sending a sequence of maliciously crafted packets that trigger the parser to read stack or heap memory containing internal state variables, cryptographic keys, session tokens, or other confidential data belonging to the telecommunications infrastructure.
The operational impact of this vulnerability is significant for any organization relying on libosmocore for its mobile network operations. Since GSM 04.80 messages are exchanged frequently during call setup and supplementary service activation, an attacker does not necessarily need a high level of access or complex multi-stage exploitation to trigger the condition. A remote adversary positioned within the signaling path can send single-shot malicious packets to induce information disclosure. This capability aligns with ATT&CK technique T1530, Data from Local System, specifically relating to data staging and exfiltration via memory scraping techniques adapted for network protocols. The leakage of sensitive internal state or cryptographic material could facilitate further attacks, such as session hijacking, impersonation of legitimate users, or bypassing authentication mechanisms in subsequent interactions with the mobile core network. For telecommunications providers, this represents a direct threat to service confidentiality and integrity, potentially leading to regulatory non-compliance regarding customer data protection standards like GDPR or HIPAA if personal subscriber information is exposed.
Mitigation strategies for this vulnerability primarily involve upgrading libosmocore to version 1.15.0 or later, where the developers have implemented stricter validation logic within the GSM 04.80 parser to ensure that all buffer accesses remain within allocated boundaries. Organizations unable to immediately upgrade should implement network-level controls such as deep packet inspection firewalls configured to detect and drop malformed GSM signaling packets with anomalous length fields or unexpected data patterns. Additionally, deploying intrusion detection systems tuned for mobile core protocol anomalies can help identify attempted exploitation in real-time. It is also advisable to review application logs for signs of segmentation faults or abnormal memory access errors that might indicate active probing against this flaw. Regular security audits and static code analysis focused on C/C++ buffer handling practices are recommended to prevent similar out-of-bounds issues in other components of the telecommunications software stack, ensuring a robust defense-in-depth posture against protocol-level exploitation attempts.