CVE-2026-75892 in osmo-ggsn
Summary
by MITRE • 09/18/2026
In osmo-ggsn 1.14.0 an out of bounds write issue was found in the gtp_decode_pdp_ctx() function through the PDP context GSN-Address sub-field, leading to memory corruption.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/18/2026
The vulnerability identified in Osmo-GGSN version 1.14.0 represents a critical security flaw within the General Packet Radio Service (GPRS) Tunneling Protocol implementation, specifically affecting the handling of PDP context information elements during session management procedures. The root cause lies in the gtp_decode_pdp_ctx() function, which is responsible for parsing incoming GTP packets to extract and validate PDP context data before processing or forwarding it within the mobile network infrastructure. This particular flaw manifests as an out-of-bounds write condition triggered by a malformed GSN-Address sub-field contained within the PDP Context Request or Update messages. When a remote attacker crafts a maliciously sized or structured address field, the parsing logic fails to correctly validate the length of the input against the allocated buffer size, allowing data to be written beyond the boundaries of the intended memory region.
From a technical perspective, this vulnerability is classified under CWE-787: Out-of-bounds Write, which describes situations where software writes data past the end or before the beginning of the intended buffer. In the context of GTP, the GSN-Address field typically contains an IP address and potentially other addressing information required to route user plane traffic between the Serving GPRS Support Node (SGSN) and the Gateway GPRS Support Node (GGSN). The lack of rigorous bounds checking during the decoding process means that excessive input data can overwrite adjacent memory locations. This corruption may affect critical control structures, stack variables, or heap metadata depending on where the function resides in memory. Such memory corruption is particularly dangerous because it provides an attacker with a mechanism to alter program execution flow or inject arbitrary code into the vulnerable service.
The operational impact of this vulnerability is severe due to its potential for remote exploitation without authentication. Since GTP-C signaling messages are often exchanged between network elements that may be considered trusted peers, many deployments do not enforce strict access control lists on all internal interfaces. An attacker positioned within reach of the Osmo-GGSN instance can send specially crafted packets to trigger this out-of-bounds write. The immediate consequence is memory corruption, which typically leads to application crashes and denial of service conditions as the GTP process terminates unexpectedly. However, with precise exploitation techniques such as heap spraying or stack pivoting, an attacker could potentially achieve arbitrary code execution on the host system running Osmo-GGSN. This would allow full compromise of the mobile core network component, enabling interception of user traffic, bypassing billing mechanisms, or using the compromised node as a pivot point for further attacks against other internal services.
This vulnerability aligns with MITRE ATT&CK technique T1203: Exploitation for Client Execution if leveraged to deploy malware on client devices via malicious GTP payloads, though more directly it facilitates privilege escalation and lateral movement within the network infrastructure once initial access is gained through service compromise. It also relates to CWE-20: Improper Input Validation, as the core failure stems from insufficient sanitization of external data before processing. The flaw highlights a common risk in telecommunications software where performance optimizations sometimes bypass rigorous input validation checks on assumed-trusted internal protocols.
Mitigation strategies must focus on immediate patching and network segmentation until updates are applied. Operators should upgrade Osmo-GGSN to version 1.14.1 or later, which includes the necessary bounds checking fixes in the gtp_decode_pdp_ctx() function. In environments where upgrading is not immediately feasible, implementing strict firewall rules to restrict GTP-C traffic to only known and authorized SGSN IP addresses can significantly reduce the attack surface. Additionally, enabling deep packet inspection on network boundaries that terminate untrusted connections can help detect malformed packets with abnormal length fields before they reach the vulnerable service. Regular security audits of protocol parsers are essential to prevent similar out-of-bounds issues in other components of the mobile core infrastructure.