CVE-2026-75895 in libsmpp34
Summary
by MITRE • 09/18/2026
In libsmpp35 from 0.1.0 through 1.8.0 out of bound read issue was found in the at smpp34_unpack() function via attacker controlled SMPP PDUs, leading to memory corruption.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/18/2026
The vulnerability identified within the libsmpp35 library, affecting versions from 0.1.0 through 1.8.0, represents a critical security flaw rooted in improper input validation and boundary checking during the parsing of Short Message Peer-to-Peer Protocol data units. The core issue resides specifically within the smpp34_unpack() function, which is responsible for deserializing incoming SMPP protocol data units into internal structures. When an attacker supplies maliciously crafted or malformed SMPP PDUs, the library fails to correctly verify that the length fields contained within these packets correspond accurately to the actual amount of available data in the buffer. This discrepancy allows the parsing logic to proceed beyond the allocated memory boundaries, resulting in a classic out-of-bounds read condition.
From a technical perspective, this flaw exploits the assumption that incoming protocol messages are well-formed and adhere strictly to the SMPP specification length constraints. In practice, network-based attacks can inject PDUs where the declared length exceeds the actual payload size or misaligns with buffer boundaries. Because libsmpp35 does not perform rigorous bounds checking before accessing memory locations based on these untrusted length values, it reads data from adjacent memory regions that do not belong to the intended structure. This behavior is categorized under CWE-126, which denotes Buffer Over-read vulnerabilities, and aligns with ATT&CK technique T1078, as such exploits are often leveraged in conjunction with valid credentials or trusted connections to facilitate further compromise.
The operational impact of this vulnerability extends beyond simple data leakage. While the immediate manifestation is an out-of-bounds read, which typically results in information disclosure by exposing sensitive memory contents to the attacker, it can also lead to application instability and denial of service conditions if the accessed memory contains invalid pointers or causes segmentation faults during subsequent processing steps. In more complex scenarios involving heap-based allocations, such boundary violations might be chained with other vulnerabilities to achieve arbitrary code execution, although the primary classification here remains focused on the read aspect. The integrity of the SMPP gateway or messaging infrastructure relying on this library is therefore compromised, as attackers can potentially extract cryptographic keys, session tokens, or internal application state information that resides in memory adjacent to the parsed structures.
Mitigation strategies for this vulnerability require immediate action by system administrators and developers utilizing libsmpp35. The most effective remediation is upgrading the library to a version newer than 1.8.0, where the smpp34_unpack() function has been patched with robust input validation mechanisms that strictly enforce buffer limits before any memory access occurs. For environments where an immediate upgrade is not feasible, implementing network-level filtering rules can provide temporary relief by inspecting SMPP traffic for anomalies in PDU length fields and dropping packets that exceed expected maximum sizes or exhibit structural inconsistencies. Additionally, deploying runtime application self-protection tools or intrusion detection systems capable of detecting abnormal memory access patterns may help mitigate the exploitation window until a permanent fix is applied.