# CVE-2026-104598: libosmo-sigtran out-of-bounds read in M3UA NOTIFY decoder

Source: https://junglewise.ai/threats/cve-2026-104598-libosmo-sigtran-through-2-2-1-contains-an-out-of-bounds-read-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-26. Updated: 2026-10-26  
License: CC BY 4.0 with a link back

CVE-2026-104598 · Severity: info · Published 2026-10-26

libosmo-sigtran is a signaling protocol library used in telecommunications systems to handle network routing and management messages. An out-of-bounds memory read vulnerability in the M3UA NOTIFY message decoder could allow a remote attacker to read sensitive data from the application's memory. The vulnerability exists because the code did not properly validate that notification strings were null-terminated before copying them.

Vendors: [Osmocom](https://junglewise.ai/threats/vendors/osmocom).

## Quick answers

**Is CVE-2026-104598 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-104598 being exploited in the wild.

**How severe is CVE-2026-104598?** Informational severity, published 26 October 2026.

**Which products and versions are affected?** Osmocom Libosmo-Sigtran through 2.2.1.

**Is there a fix for CVE-2026-104598?** Yes: fixed in Fixed in commit b554131f2cbb20ca9a9cf51ca17d73f644eff1f8 (versions after 2.2.1). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-104598 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-104598?** Check whether you run Osmocom Libosmo-Sigtran at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Fixed in commit b554131f2cbb20ca9a9cf51ca17d73f644eff1f8 (versions after 2.2.1)

## Technical details

The M3UA NOTIFY decoder in src/m3ua.c performs an unsafe memory copy of an INFO String IE (Information Element) without ensuring null termination, leading to an out-of-bounds read. The decoder is reachable by any remote peer sending a crafted M3UA NOTIFY message over the network. An attacker can leak sensitive information from adjacent memory by sending messages with improperly terminated strings.

## Affected products

- osmocom libosmo-sigtran through 2.2.1

## Timeline

- 2026-10-26: disclosed

## References

- [https://github.com/osmocom/libosmo-sigtran/commit/b554131f2cbb20ca9a9cf51ca17d73f644eff1f8](https://github.com/osmocom/libosmo-sigtran/commit/b554131f2cbb20ca9a9cf51ca17d73f644eff1f8)
- [https://osmocom.org/issues/7056](https://osmocom.org/issues/7056)