# Osmocom vulnerabilities Source: https://junglewise.ai/threats/vendors/osmocom Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/osmocom.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 11 vulnerabilities in Osmocom: 0 in the last 7 days and 11 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-104598, was published on 26 October 2026. 7 vulnerabilities in the last four weeks, up 75% on the four before (4). 1 technology has a page of its own. ## Counts - Last 7 days: 0 - Last 30 days: 7 - Last 90 days: 11 - All time: 11 (0 critical, 0 exploited in the wild) ## About Osmocom German telecommunications software project providing open-source cellular network infrastructure and tools. ## Latest Osmocom vulnerabilities - [CVE-2026-104598: libosmo-sigtran out-of-bounds read in M3UA NOTIFY decoder](https://junglewise.ai/threats/cve-2026-104598-libosmo-sigtran-through-2-2-1-contains-an-out-of-bounds-read-in) (info, published 26 Oct 2026) - [CVE-2026-104597: libosmocore out-of-bounds read in IuUP initialization](https://junglewise.ai/threats/cve-2026-104597-libosmocore-through-1-14-1-contains-an-out-of-bounds-read-in) (info, published 26 Oct 2026) - [CVE-2026-104596: libosmocore out-of-bounds read in GSM 04.80 parser](https://junglewise.ai/threats/cve-2026-104596-libosmocore-through-1-14-1-contains-out-of-bounds-reads-in-the) (info, published 26 Oct 2026) - [CVE-2026-104594: libosmocore out-of-bounds read in IPA CCM identity-tag parsing](https://junglewise.ai/threats/cve-2026-104594-libosmocore-through-1-14-1-contains-out-of-bounds-reads-in-the) (info, published 26 Oct 2026) - [CVE-2026-104593: osmo-msc stack-based buffer overflow in decode_mme_name()](https://junglewise.ai/threats/cve-2026-104593-osmo-msc-through-1-15-0-contains-a-stack-based-buffer-overflow) (info, published 26 Oct 2026) - [CVE-2026-104592: libosmocore out-of-bounds read in CBSP decoder](https://junglewise.ai/threats/cve-2026-104592-libosmocore-through-1-14-1-contains-an-out-of-bounds-read-in-the) (info, published 26 Oct 2026) - [CVE-2026-104591: libosmocore buffer overflow in osmo_iuup_compute_payload_crc()](https://junglewise.ai/threats/cve-2026-104591-libosmocore-through-1-14-1-contains-a-buffer-overflow-in-osmo) (info, published 26 Oct 2026) - [CVE-2026-75895: libsmpp34 out-of-bounds read in smpp34_unpack function](https://junglewise.ai/threats/cve-2026-75895-in-libsmpp35-from-0-1-0-through-1-8-0-out-of-bound-read-issue-was) (high, CVSS 7.5, published 18 Sep 2026) - [CVE-2026-75894: Osmocom osmo-iuh assertion failure in RANAP NAS-PDU handling](https://junglewise.ai/threats/cve-2026-75894-in-osmo-iuh-from-0-1-0-through-1-8-0-a-reachable-assertion-was) (high, CVSS 7.5, published 18 Sep 2026) - [CVE-2026-75893: Osmocom osmo-bsc heap buffer overflow in ipaccess proxy](https://junglewise.ai/threats/cve-2026-75893-in-osmo-bsc-from-1-0-1-through-1-14-1-a-heap-based-buffer) (high, CVSS 7.5, published 18 Sep 2026) - [CVE-2026-75892: osmo-ggsn out-of-bounds write in PDP context GSN-Address decode](https://junglewise.ai/threats/cve-2026-75892-in-osmo-ggsn-1-14-0-an-out-of-bounds-write-issue-was-found-in-the) (medium, CVSS 6.5, published 18 Sep 2026) ## Most severe Osmocom vulnerabilities - [CVE-2026-75894: Osmocom osmo-iuh assertion failure in RANAP NAS-PDU handling](https://junglewise.ai/threats/cve-2026-75894-in-osmo-iuh-from-0-1-0-through-1-8-0-a-reachable-assertion-was) (high, CVSS 7.5, published 18 Sep 2026) - [CVE-2026-75893: Osmocom osmo-bsc heap buffer overflow in ipaccess proxy](https://junglewise.ai/threats/cve-2026-75893-in-osmo-bsc-from-1-0-1-through-1-14-1-a-heap-based-buffer) (high, CVSS 7.5, published 18 Sep 2026) - [CVE-2026-75895: libsmpp34 out-of-bounds read in smpp34_unpack function](https://junglewise.ai/threats/cve-2026-75895-in-libsmpp35-from-0-1-0-through-1-8-0-out-of-bound-read-issue-was) (high, CVSS 7.5, published 18 Sep 2026) - [CVE-2026-75892: osmo-ggsn out-of-bounds write in PDP context GSN-Address decode](https://junglewise.ai/threats/cve-2026-75892-in-osmo-ggsn-1-14-0-an-out-of-bounds-write-issue-was-found-in-the) (medium, CVSS 6.5, published 18 Sep 2026) - [CVE-2026-104598: libosmo-sigtran out-of-bounds read in M3UA NOTIFY decoder](https://junglewise.ai/threats/cve-2026-104598-libosmo-sigtran-through-2-2-1-contains-an-out-of-bounds-read-in) (info, published 26 Oct 2026) - [CVE-2026-104597: libosmocore out-of-bounds read in IuUP initialization](https://junglewise.ai/threats/cve-2026-104597-libosmocore-through-1-14-1-contains-an-out-of-bounds-read-in) (info, published 26 Oct 2026) - [CVE-2026-104596: libosmocore out-of-bounds read in GSM 04.80 parser](https://junglewise.ai/threats/cve-2026-104596-libosmocore-through-1-14-1-contains-out-of-bounds-reads-in-the) (info, published 26 Oct 2026) - [CVE-2026-104594: libosmocore out-of-bounds read in IPA CCM identity-tag parsing](https://junglewise.ai/threats/cve-2026-104594-libosmocore-through-1-14-1-contains-out-of-bounds-reads-in-the) (info, published 26 Oct 2026) - [CVE-2026-104593: osmo-msc stack-based buffer overflow in decode_mme_name()](https://junglewise.ai/threats/cve-2026-104593-osmo-msc-through-1-15-0-contains-a-stack-based-buffer-overflow) (info, published 26 Oct 2026) - [CVE-2026-104592: libosmocore out-of-bounds read in CBSP decoder](https://junglewise.ai/threats/cve-2026-104592-libosmocore-through-1-14-1-contains-an-out-of-bounds-read-in-the) (info, published 26 Oct 2026) ## Vulnerabilities per week 7 vulnerabilities in the last four weeks, up 75% on the four before (4). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 4 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 7 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Osmocom technologies - [Osmocom Libosmocore](https://junglewise.ai/threats/technologies/libosmocore): 5 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Osmocom vulnerabilities", https://junglewise.ai/threats/vendors/osmocom, 9 November 2026.