CVE-2026-104597

None

CVSS

—

EPSS

0.2%

Published

Oct 26, 2026

CISA due date

—

The record

libosmocore through 1.14.1 contains an out-of-bounds read in iuup_rx_initialization() in src/gsm/iuup.c. This allows a remote attacker to obtain sensitive information.

Affected packages

Ecosystem	Package	Introduced	Fixed