Quick answers
- Is CVE-2026-104592 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-104592 being exploited in the wild.
- How severe is CVE-2026-104592?
- Informational severity, published 26 October 2026.
- Which products and versions are affected?
- Osmocom Libosmocore through 1.14.1.
- Is there a fix for CVE-2026-104592?
- Yes: fixed in libosmocore 1.14.2 or later (fix committed as 1659b58). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-104592 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-104592?
- Check whether you run Osmocom Libosmocore at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: libosmocore 1.14.2 or later (fix committed as 1659b58)
Technical details
The CBSP WRITE-REPLACE decoder in src/gsm/cbsp.c reads an 8-bit page count from untrusted network input and uses it directly as an array bound, allowing access beyond a 16-entry stack buffer. This out-of-bounds read occurs in cbsp_dec_write_repl() and can be triggered by any remote entity sending a crafted CBSP message without authentication. An attacker gains denial of service through application crash; memory disclosure is theoretically possible depending on adjacent stack content.
Affected products
- osmocom libosmocore through 1.14.1
Timeline
- 2026-10-26: disclosed