CVE-2026-75893 in osmo-bsc
Summary
by MITRE • 09/18/2026
In osmo-bsc from 1.0.1 through 1.14.1 a heap based buffer overflow issue was found in the ipaccess_proxy_read_msg() function via IPA frame lengths.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/18/2026
The vulnerability identified within OsmoBSC versions ranging from 1.0.1 to 1.14.1 represents a critical memory safety failure located specifically within the ipaccess_proxy_read_msg function. This component is responsible for handling incoming Integrated Access (IPA) frames, which are fundamental to the signaling protocols used in OpenBTS and related GSM network infrastructure. The core technical flaw stems from an insufficient validation of frame length parameters provided by external entities or internal processing logic before memory allocation occurs. When a maliciously crafted IPA frame with an excessively large length field is processed, the application attempts to allocate heap memory based on this untrusted input without verifying that the size falls within acceptable bounds relative to available system resources or expected protocol limits.
This lack of boundary checking leads directly to a heap-based buffer overflow condition. As the program proceeds to copy data from the incoming frame into the allocated buffer, it writes beyond the end of the allocated memory region. This out-of-bounds write operation corrupts adjacent heap metadata and potentially overwrites critical application state variables stored in nearby memory locations. In C/C++ based systems like OsmoBSC, such corruption is particularly dangerous because the heap manager relies on this metadata for subsequent allocation and deallocation operations. An attacker who can control the content of the overflowed data may be able to manipulate these overwritten structures to achieve arbitrary code execution with the privileges of the running process, typically root or a dedicated service account depending on deployment configuration.
From an operational perspective, the impact of this vulnerability is severe for any network operator relying on OsmoBSC as part of their Base Station Controller infrastructure. Successful exploitation could allow a remote attacker to crash the BSC service, leading to a denial of service that disrupts connectivity for all connected mobile devices in the coverage area. More critically, if the heap corruption allows for code execution, it provides a pathway for full system compromise. This could result in unauthorized access to sensitive subscriber data, interception of voice and SMS traffic, or use of the compromised server as a pivot point for further attacks against the core network elements such as the Home Location Register or Mobile Switching Center. The vulnerability is classified under CWE-120 Buffer Copy without Checking Size of Input which accurately describes the root cause where input validation was omitted prior to memory operations.
The attack vector aligns with ATT&CK techniques related to exploitation for privilege escalation and defense evasion, specifically leveraging buffer overflow mechanisms common in legacy network protocols that may not enforce strict length checks by design. Mitigation strategies must prioritize immediate patching of all affected OsmoBSC instances to versions released after 1.14.1 where this issue has been resolved through rigorous input validation and bounds checking within the ipaccess_proxy_read_msg function. Network administrators should also implement network segmentation to restrict access to IPA interfaces from untrusted networks, ensuring that only authorized base stations can communicate with the BSC. Additionally, deploying intrusion detection systems capable of identifying anomalous packet sizes or malformed protocol structures can provide an additional layer of defense against exploitation attempts while patching efforts are underway.