{"id":"CVE-2026-104594","title":"libosmocore through 1.14.1 contains out-of-bounds reads in the IPA CCM identity-tag parsers in src/gsm/ipa.c","summary":"libosmocore through 1.14.1 contains out-of-bounds reads in the IPA CCM identity-tag parsers in src/gsm/ipa.c. This allows a remote attacker to obtain sensitive information.","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvssSource":"adp","ssvc":{"exploitation":"poc","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-30T16:28:49.166712Z"},"exploitAvailable":true,"published":"2026-10-26","updated":"2026-10-30","sourceUpdated":"2026-10-30T17:15:09.899Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-104594","references":[{"url":"https://osmocom.org/issues/7050"},{"url":"https://github.com/osmocom/libosmocore/commit/8ba652bca2f28ec05ff5979846199e2c46657633"},{"url":"https://github.com/osmocom/libosmocore/commit/325ffb5204d7e1659ca2fec3b2f14c33b969ee71"},{"url":"https://github.com/osmocom/libosmocore/commit/afd18bf00147e17c495fc909ac4583b3bf734d53"}],"tags":["cve.org","exploit-available"],"epss":0.00466,"epssPercentile":0.40484,"ingestedAt":"2026-10-26T19:38:01.339Z","slug":"CVE-2026-104594","body":"## Overview\n\nlibosmocore through 1.14.1 contains out-of-bounds reads in the IPA CCM identity-tag parsers in src/gsm/ipa.c. This allows a remote attacker to obtain sensitive information.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":53,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":233157,"id":"CVE-2026-104594","ts":1793895914923,"field":"exploit_available","old":"false","new":"true"},{"seq":233156,"id":"CVE-2026-104594","ts":1793895914923,"field":"cvss","old":null,"new":"7.5"},{"seq":233155,"id":"CVE-2026-104594","ts":1793895914923,"field":"severity","old":"none","new":"high"}]}