CVE-2026-75894 in osmo-iuh
Summary
by MITRE • 09/18/2026
In osmo-iuh from 0.1.0 through 1.8.0 a reachable assertion was found in the ranap_handle_co_dt() function via a arbitrarily sized NAS-PDU that leads to process crash and remote denial of service.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/18/2026
The vulnerability identified within osmo-iuh versions ranging from 0.1.0 through 1.8.0 represents a critical reliability flaw in the Radio Network Controller Application Part handling logic, specifically located in the ranap_handle_co_dt function. This component is responsible for processing control plane data transfer messages which are essential for maintaining signaling connections between the mobile station and the core network over the Iu interface. The root cause of this issue lies in insufficient input validation regarding the size or structure of the Network Attachment Service (NAS) Protocol Data Unit, commonly referred to as NAS-PDU. When an attacker crafts a message with an arbitrarily sized NAS-PDU that deviates from expected parameters, the software fails to perform necessary bounds checking before attempting to process or copy the data into internal buffers.
This lack of validation triggers a reachable assertion failure within the application logic. In C-based systems like osmo-iuh, assertions are typically used as debug mechanisms to catch programming errors during development but remain enabled in production builds for stability monitoring purposes. When such an assertion is triggered by malformed input from a remote peer, it causes the process to abort immediately and terminate with a core dump. This behavior transforms what might otherwise be a silent data corruption or logic error into a deterministic crash scenario that can be exploited remotely without authentication. The attacker simply needs to send the specially crafted NAS-PDU over the network interface exposed by the osmo-iuh service, leading directly to the termination of the signaling process.
The operational impact of this vulnerability is severe due to its potential for remote denial of service. Since osmo-iuh serves as a critical intermediary in mobile telecommunications infrastructure, particularly in OpenBTS and similar open-source cellular network implementations, crashing this component disrupts all active sessions handled by that specific instance. This results in the immediate loss of connectivity for users attached to the affected node, effectively taking down a portion or entirety of the local cell coverage area depending on deployment topology. Furthermore, if the service is configured with automatic restart mechanisms common in production environments, an attacker could sustain this denial of service through repeated exploitation attempts, causing continuous resource consumption and instability that degrades overall network performance and availability for legitimate users.
From a classification perspective, this vulnerability aligns closely with CWE-20 Improper Input Validation, as the system fails to verify that user-supplied input meets expected constraints before processing. Additionally, it relates to CWE-617 Reachable Assertion because the assertion is not confined to unreachable code paths but can be triggered by external network traffic. In terms of attack vectors and tactics, this flaw facilitates remote exploitation consistent with ATT&CK technique T1498 Network Denial of Service, where an adversary disrupts service availability rather than compromising data confidentiality or integrity. The specific mechanism involves sending malicious packets to trigger a crash in the signaling plane, which is distinct from volumetric attacks but equally disruptive to operational continuity.
Mitigation strategies for this vulnerability primarily involve upgrading to patched versions of osmo-iuh released after 1.8.0 where developers have addressed the input validation gaps in the ranap_handle_co_dt function. Until an upgrade can be performed, network administrators should implement strict access control lists on the Iu interface to restrict traffic only from trusted base stations and core network elements, thereby reducing the attack surface available to external adversaries. Additionally, deploying intrusion detection systems capable of identifying anomalous NAS-PDU sizes or malformed signaling messages can help in filtering out malicious packets before they reach the vulnerable application logic. It is also advisable to configure process monitoring tools that detect unexpected terminations and automatically restart services with minimal downtime while ensuring core dumps are analyzed for forensic purposes to confirm exploitation attempts.