{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2026-104597", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2026-10-26T19:24:14.234Z", "dateReserved": "2026-10-02T00:00:00.000Z", "datePublished": "2026-10-26T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-10-26T19:24:14.234Z"}, "descriptions": [{"lang": "en", "value": "libosmocore through 1.14.1 contains an out-of-bounds read in iuup_rx_initialization() in src/gsm/iuup.c. This allows a remote attacker to obtain sensitive information."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://osmocom.org/issues/7052"}, {"url": "https://github.com/osmocom/libosmocore/commit/89e5ade1a01953752a53d83da4ba0b3ddbc30e30"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}}, "dataVersion": "5.2"}

{}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "libosmocore through 1.14.1 contains an out-of-bounds read in iuup_rx_initialization() in src/gsm/iuup.c. This allows a remote attacker to obtain sensitive information."}], "id": "CVE-2026-104597", "lastModified": "2026-10-27T15:00:49.240", "metrics": {}, "published": "2026-10-26T20:17:37.780", "references": [{"source": "cve@mitre.org", "url": "https://github.com/osmocom/libosmocore/commit/89e5ade1a01953752a53d83da4ba0b3ddbc30e30"}, {"source": "cve@mitre.org", "url": "https://osmocom.org/issues/7052"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred"}

{"bugzilla": {"description": "libosmocore: libosmocore: Information disclosure via out-of-bounds read in iuup_rx_initialization", "id": "2561034", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2561034"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "status": "draft"}, "cwe": "CWE-125", "details": ["libosmocore through 1.14.1 contains an out-of-bounds read in iuup_rx_initialization() in src/gsm/iuup.c. This allows a remote attacker to obtain sensitive information.", "A flaw was found in libosmocore. An out-of-bounds read vulnerability in the iuup_rx_initialization function allows a remote attacker to obtain sensitive data. By sending specially crafted initialization network packets, an attacker can cause the application to read memory past the allocated buffer, leading to information disclosure."], "name": "CVE-2026-104597", "public_date": "2026-10-26T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-104597\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-104597\nhttps://github.com/osmocom/libosmocore/commit/89e5ade1a01953752a53d83da4ba0b3ddbc30e30\nhttps://osmocom.org/issues/7052"], "statement": "This vulnerability is rated as Moderate impact because an unauthenticated remote attacker could trigger out-of-bounds memory disclosure without the ability to corrupt system memory or cause a denial of service. The affected libosmocore library is not shipped or supported in Red Hat Enterprise Linux or other Red Hat enterprise products, restricting exposure exclusively to Fedora community releases. Exploitation is limited to network services that actively parse incoming IuUP initialization frames, preventing wider impact across general workloads.", "threat_severity": "Moderate"}

{"created": "2026-10-26T20:30:15.338723+00:00", "updated": "2026-10-30T15:30:16.639167+00:00", "vendors": []}