Osmocom vulnerabilities

Products

• libsmpp34 1
• osmo-bsc 1
• osmo-ggsn 1
• osmo-iuh 1

Latest Osmocom CVEs

Newest publication first

1. CVE-2026-75895 Out of bounds read at smpp34_unpack()

   Published 2026-09-18

   High·CVSS 7.5 EPSS 0.43%

   In libsmpp35 from 0.1.0 through 1.8.0 out of bound read issue was found in the at smpp34_unpack() function via attacker controlled SMPP PDUs, leading to memory corruption.

2. CVE-2026-75894 Reachable assertion at ranap_handle_co_dt()

   Published 2026-09-18

   High·CVSS 7.5 EPSS 0.31%

   In osmo-iuh from 0.1.0 through 1.8.0 a reachable assertion was found in the ranap_handle_co_dt() function via a arbitrarily sized NAS-PDU that leads to process crash and remote denial of service.

3. CVE-2026-75893 Heap based buffer overflow at ipaccess_proxy_read_msg()

   Published 2026-09-18

   High·CVSS 7.5 EPSS 0.46%

   In osmo-bsc from 1.0.1 through 1.14.1 a heap based buffer overflow issue was found in the ipaccess_proxy_read_msg() function via IPA frame lengths.

4. CVE-2026-75892 Out of bounds write in PDP ctx GSN-Address decode

   Published 2026-09-18

   Medium·CVSS 6.5 EPSS 0.28%

   In osmo-ggsn 1.14.0 an out of bounds write issue was found in the gtp_decode_pdp_ctx() function through the PDP context GSN-Address sub-field, leading to memory corruption.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.