{"id":"UBUNTU-CVE-2026-104592","details":"libosmocore through 1.14.1 contains an out-of-bounds read in the CBSP WRITE-REPLACE decoder in src/gsm/cbsp.c. This allows a remote attacker to cause a denial of service.","modified":"2026-10-28T17:50:29Z","published":"2026-10-26T19:16:00Z","upstream":["CVE-2026-104592"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-104592"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2026-104592"},{"type":"REPORT","url":"https://gerrit.osmocom.org/c/libosmocore/+/43215"},{"type":"REPORT","url":"https://github.com/cveproject/cvelistv5/tree/main/cves/2026/104xxx/cve-2026-104592.json"},{"type":"REPORT","url":"https://github.com/osmocom/libosmocore/commit/1659b5874223934d5586e3e96b7d59f653c90ea6"},{"type":"REPORT","url":"https://nvd.nist.gov/vuln/detail/cve-2026-104592"},{"type":"REPORT","url":"https://osmocom.org/issues/7053"},{"type":"REPORT","url":"https://security-tracker.debian.org/tracker/cve-2026-104592"}],"affected":[{"package":{"name":"libosmocore","ecosystem":"Ubuntu:16.04:LTS","purl":"pkg:deb/ubuntu/libosmocore?arch=source&distro=xenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.0-4"],"ecosystem_specific":{"binaries":[{"binary_version":"0.9.0-4","binary_name":"libosmocodec0"},{"binary_name":"libosmocore","binary_version":"0.9.0-4"},{"binary_name":"libosmocore-utils","binary_version":"0.9.0-4"},{"binary_name":"libosmocore6","binary_version":"0.9.0-4"},{"binary_name":"libosmoctrl0","binary_version":"0.9.0-4"},{"binary_name":"libosmogb4","binary_version":"0.9.0-4"},{"binary_name":"libosmogsm5","binary_version":"0.9.0-4"},{"binary_version":"0.9.0-4","binary_name":"libosmosim0"},{"binary_name":"libosmovty3","binary_version":"0.9.0-4"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-104592.json"}},{"package":{"name":"libosmocore","ecosystem":"Ubuntu:18.04:LTS","purl":"pkg:deb/ubuntu/libosmocore?arch=source&distro=bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.0-7"],"ecosystem_specific":{"binaries":[{"binary_name":"libosmocodec0","binary_version":"0.9.0-7"},{"binary_name":"libosmocore","binary_version":"0.9.0-7"},{"binary_name":"libosmocore-utils","binary_version":"0.9.0-7"},{"binary_name":"libosmocore6","binary_version":"0.9.0-7"},{"binary_name":"libosmoctrl0","binary_version":"0.9.0-7"},{"binary_version":"0.9.0-7","binary_name":"libosmogb4"},{"binary_name":"libosmogsm5","binary_version":"0.9.0-7"},{"binary_name":"libosmosim0","binary_version":"0.9.0-7"},{"binary_name":"libosmovty3","binary_version":"0.9.0-7"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-104592.json"}},{"package":{"name":"libosmocore","ecosystem":"Ubuntu:20.04:LTS","purl":"pkg:deb/ubuntu/libosmocore?arch=source&distro=focal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.12.1-3","0.12.1-3ubuntu1"],"ecosystem_specific":{"binaries":[{"binary_name":"libosmocodec0","binary_version":"0.12.1-3ubuntu1"},{"binary_version":"0.12.1-3ubuntu1","binary_name":"libosmocoding0"},{"binary_version":"0.12.1-3ubuntu1","binary_name":"libosmocore"},{"binary_name":"libosmocore-utils","binary_version":"0.12.1-3ubuntu1"},{"binary_version":"0.12.1-3ubuntu1","binary_name":"libosmocore11"},{"binary_version":"0.12.1-3ubuntu1","binary_name":"libosmoctrl0"},{"binary_name":"libosmogb6","binary_version":"0.12.1-3ubuntu1"},{"binary_name":"libosmogsm10","binary_version":"0.12.1-3ubuntu1"},{"binary_name":"libosmosim0","binary_version":"0.12.1-3ubuntu1"},{"binary_version":"0.12.1-3ubuntu1","binary_name":"libosmovty4"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-104592.json"}},{"package":{"name":"libosmocore","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/libosmocore?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.2-3","1.6.0-3","1.6.0-3build1"],"ecosystem_specific":{"binaries":[{"binary_name":"libosmocodec0","binary_version":"1.6.0-3build1"},{"binary_version":"1.6.0-3build1","binary_name":"libosmocoding0"},{"binary_name":"libosmocore","binary_version":"1.6.0-3build1"},{"binary_name":"libosmocore-utils","binary_version":"1.6.0-3build1"},{"binary_name":"libosmocore18","binary_version":"1.6.0-3build1"},{"binary_name":"libosmoctrl0","binary_version":"1.6.0-3build1"},{"binary_name":"libosmogb12","binary_version":"1.6.0-3build1"},{"binary_name":"libosmogsm17","binary_version":"1.6.0-3build1"},{"binary_version":"1.6.0-3build1","binary_name":"libosmosim2"},{"binary_version":"1.6.0-3build1","binary_name":"libosmovty9"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-104592.json"}},{"package":{"name":"libosmocore","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/libosmocore?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.0-3","1.7.0-3.1build1","1.7.0-3.1build2"],"ecosystem_specific":{"binaries":[{"binary_version":"1.7.0-3.1build2","binary_name":"libosmocodec0t64"},{"binary_version":"1.7.0-3.1build2","binary_name":"libosmocoding0t64"},{"binary_version":"1.7.0-3.1build2","binary_name":"libosmocore"},{"binary_name":"libosmocore-utils","binary_version":"1.7.0-3.1build2"},{"binary_name":"libosmocore19t64","binary_version":"1.7.0-3.1build2"},{"binary_name":"libosmoctrl0t64","binary_version":"1.7.0-3.1build2"},{"binary_name":"libosmogb14t64","binary_version":"1.7.0-3.1build2"},{"binary_name":"libosmogsm18t64","binary_version":"1.7.0-3.1build2"},{"binary_name":"libosmosim2t64","binary_version":"1.7.0-3.1build2"},{"binary_name":"libosmovty9t64","binary_version":"1.7.0-3.1build2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-104592.json"}},{"package":{"name":"libosmocore","ecosystem":"Ubuntu:26.10","purl":"pkg:deb/ubuntu/libosmocore?arch=source&distro=stonking"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.11.0-2build1"],"ecosystem_specific":{"binaries":[{"binary_name":"libosmocodec4","binary_version":"1.11.0-2build1"},{"binary_name":"libosmocoding0","binary_version":"1.11.0-2build1"},{"binary_name":"libosmocore","binary_version":"1.11.0-2build1"},{"binary_name":"libosmocore-utils","binary_version":"1.11.0-2build1"},{"binary_version":"1.11.0-2build1","binary_name":"libosmocore22"},{"binary_name":"libosmoctrl0","binary_version":"1.11.0-2build1"},{"binary_name":"libosmogb14","binary_version":"1.11.0-2build1"},{"binary_name":"libosmogsm20","binary_version":"1.11.0-2build1"},{"binary_version":"1.11.0-2build1","binary_name":"libosmoisdn0"},{"binary_version":"1.11.0-2build1","binary_name":"libosmosim2"},{"binary_name":"libosmovty13","binary_version":"1.11.0-2build1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-104592.json"}},{"package":{"name":"libosmocore","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/libosmocore?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.11.0-2","1.11.0-2build1"],"ecosystem_specific":{"binaries":[{"binary_version":"1.11.0-2build1","binary_name":"libosmocodec4"},{"binary_name":"libosmocoding0","binary_version":"1.11.0-2build1"},{"binary_version":"1.11.0-2build1","binary_name":"libosmocore"},{"binary_version":"1.11.0-2build1","binary_name":"libosmocore-utils"},{"binary_name":"libosmocore22","binary_version":"1.11.0-2build1"},{"binary_version":"1.11.0-2build1","binary_name":"libosmoctrl0"},{"binary_name":"libosmogb14","binary_version":"1.11.0-2build1"},{"binary_version":"1.11.0-2build1","binary_name":"libosmogsm20"},{"binary_version":"1.11.0-2build1","binary_name":"libosmoisdn0"},{"binary_name":"libosmosim2","binary_version":"1.11.0-2build1"},{"binary_name":"libosmovty13","binary_version":"1.11.0-2build1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-104592.json"}}],"schema_version":"1.9.2","severity":[{"type":"Ubuntu","score":"medium"}]}