{"id":"UBUNTU-CVE-2026-104596","details":"libosmocore through 1.14.1 contains out-of-bounds reads in the GSM 04.80 supplementary-service component parsers in src/gsm/gsm0480.c. This allows a remote attacker to obtain sensitive information.","modified":"2026-10-31T03:30:04.466274902Z","published":"2026-10-26T20:17:00Z","upstream":["CVE-2026-104596"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-104596"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2026-104596"},{"type":"REPORT","url":"https://github.com/cveproject/cvelistv5/tree/main/cves/2026/104xxx/cve-2026-104596.json"},{"type":"REPORT","url":"https://github.com/osmocom/libosmocore/commit/b6c8c72c0c063ab2f293c5226472341c432454c2"},{"type":"REPORT","url":"https://nvd.nist.gov/vuln/detail/cve-2026-104596"},{"type":"REPORT","url":"https://osmocom.org/issues/7051"}],"affected":[{"package":{"name":"libosmocore","ecosystem":"Ubuntu:16.04:LTS","purl":"pkg:deb/ubuntu/libosmocore?arch=source&distro=xenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.0-4"],"ecosystem_specific":{"binaries":[{"binary_version":"0.9.0-4","binary_name":"libosmocodec0"},{"binary_name":"libosmocore","binary_version":"0.9.0-4"},{"binary_name":"libosmocore-utils","binary_version":"0.9.0-4"},{"binary_name":"libosmocore6","binary_version":"0.9.0-4"},{"binary_name":"libosmoctrl0","binary_version":"0.9.0-4"},{"binary_name":"libosmogb4","binary_version":"0.9.0-4"},{"binary_name":"libosmogsm5","binary_version":"0.9.0-4"},{"binary_name":"libosmosim0","binary_version":"0.9.0-4"},{"binary_name":"libosmovty3","binary_version":"0.9.0-4"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-104596.json"}},{"package":{"name":"libosmocore","ecosystem":"Ubuntu:18.04:LTS","purl":"pkg:deb/ubuntu/libosmocore?arch=source&distro=bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.0-7"],"ecosystem_specific":{"binaries":[{"binary_version":"0.9.0-7","binary_name":"libosmocodec0"},{"binary_name":"libosmocore","binary_version":"0.9.0-7"},{"binary_name":"libosmocore-utils","binary_version":"0.9.0-7"},{"binary_version":"0.9.0-7","binary_name":"libosmocore6"},{"binary_name":"libosmoctrl0","binary_version":"0.9.0-7"},{"binary_version":"0.9.0-7","binary_name":"libosmogb4"},{"binary_name":"libosmogsm5","binary_version":"0.9.0-7"},{"binary_version":"0.9.0-7","binary_name":"libosmosim0"},{"binary_name":"libosmovty3","binary_version":"0.9.0-7"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-104596.json"}},{"package":{"name":"libosmocore","ecosystem":"Ubuntu:20.04:LTS","purl":"pkg:deb/ubuntu/libosmocore?arch=source&distro=focal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.12.1-3","0.12.1-3ubuntu1"],"ecosystem_specific":{"binaries":[{"binary_version":"0.12.1-3ubuntu1","binary_name":"libosmocodec0"},{"binary_version":"0.12.1-3ubuntu1","binary_name":"libosmocoding0"},{"binary_name":"libosmocore","binary_version":"0.12.1-3ubuntu1"},{"binary_name":"libosmocore-utils","binary_version":"0.12.1-3ubuntu1"},{"binary_version":"0.12.1-3ubuntu1","binary_name":"libosmocore11"},{"binary_name":"libosmoctrl0","binary_version":"0.12.1-3ubuntu1"},{"binary_name":"libosmogb6","binary_version":"0.12.1-3ubuntu1"},{"binary_name":"libosmogsm10","binary_version":"0.12.1-3ubuntu1"},{"binary_name":"libosmosim0","binary_version":"0.12.1-3ubuntu1"},{"binary_name":"libosmovty4","binary_version":"0.12.1-3ubuntu1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-104596.json"}},{"package":{"name":"libosmocore","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/libosmocore?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.2-3","1.6.0-3","1.6.0-3build1"],"ecosystem_specific":{"binaries":[{"binary_version":"1.6.0-3build1","binary_name":"libosmocodec0"},{"binary_version":"1.6.0-3build1","binary_name":"libosmocoding0"},{"binary_name":"libosmocore","binary_version":"1.6.0-3build1"},{"binary_name":"libosmocore-utils","binary_version":"1.6.0-3build1"},{"binary_name":"libosmocore18","binary_version":"1.6.0-3build1"},{"binary_name":"libosmoctrl0","binary_version":"1.6.0-3build1"},{"binary_name":"libosmogb12","binary_version":"1.6.0-3build1"},{"binary_version":"1.6.0-3build1","binary_name":"libosmogsm17"},{"binary_name":"libosmosim2","binary_version":"1.6.0-3build1"},{"binary_version":"1.6.0-3build1","binary_name":"libosmovty9"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-104596.json"}},{"package":{"name":"libosmocore","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/libosmocore?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.0-3","1.7.0-3.1build1","1.7.0-3.1build2"],"ecosystem_specific":{"binaries":[{"binary_name":"libosmocodec0t64","binary_version":"1.7.0-3.1build2"},{"binary_name":"libosmocoding0t64","binary_version":"1.7.0-3.1build2"},{"binary_name":"libosmocore","binary_version":"1.7.0-3.1build2"},{"binary_version":"1.7.0-3.1build2","binary_name":"libosmocore-utils"},{"binary_name":"libosmocore19t64","binary_version":"1.7.0-3.1build2"},{"binary_version":"1.7.0-3.1build2","binary_name":"libosmoctrl0t64"},{"binary_name":"libosmogb14t64","binary_version":"1.7.0-3.1build2"},{"binary_name":"libosmogsm18t64","binary_version":"1.7.0-3.1build2"},{"binary_name":"libosmosim2t64","binary_version":"1.7.0-3.1build2"},{"binary_name":"libosmovty9t64","binary_version":"1.7.0-3.1build2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-104596.json"}},{"package":{"name":"libosmocore","ecosystem":"Ubuntu:26.10","purl":"pkg:deb/ubuntu/libosmocore?arch=source&distro=stonking"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.11.0-2build1"],"ecosystem_specific":{"binaries":[{"binary_name":"libosmocodec4","binary_version":"1.11.0-2build1"},{"binary_version":"1.11.0-2build1","binary_name":"libosmocoding0"},{"binary_version":"1.11.0-2build1","binary_name":"libosmocore"},{"binary_version":"1.11.0-2build1","binary_name":"libosmocore-utils"},{"binary_name":"libosmocore22","binary_version":"1.11.0-2build1"},{"binary_name":"libosmoctrl0","binary_version":"1.11.0-2build1"},{"binary_version":"1.11.0-2build1","binary_name":"libosmogb14"},{"binary_name":"libosmogsm20","binary_version":"1.11.0-2build1"},{"binary_version":"1.11.0-2build1","binary_name":"libosmoisdn0"},{"binary_name":"libosmosim2","binary_version":"1.11.0-2build1"},{"binary_name":"libosmovty13","binary_version":"1.11.0-2build1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-104596.json"}},{"package":{"name":"libosmocore","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/libosmocore?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.11.0-2","1.11.0-2build1"],"ecosystem_specific":{"binaries":[{"binary_name":"libosmocodec4","binary_version":"1.11.0-2build1"},{"binary_version":"1.11.0-2build1","binary_name":"libosmocoding0"},{"binary_name":"libosmocore","binary_version":"1.11.0-2build1"},{"binary_name":"libosmocore-utils","binary_version":"1.11.0-2build1"},{"binary_name":"libosmocore22","binary_version":"1.11.0-2build1"},{"binary_name":"libosmoctrl0","binary_version":"1.11.0-2build1"},{"binary_name":"libosmogb14","binary_version":"1.11.0-2build1"},{"binary_version":"1.11.0-2build1","binary_name":"libosmogsm20"},{"binary_version":"1.11.0-2build1","binary_name":"libosmoisdn0"},{"binary_version":"1.11.0-2build1","binary_name":"libosmosim2"},{"binary_name":"libosmovty13","binary_version":"1.11.0-2build1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-104596.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"type":"Ubuntu","score":"medium"}]}