CVE-2026-104592
waiting for further signalsZero needs more public information before it can validate it.description
libosmocore versions through 1.14.1 are affected by an out-of-bounds read while processing CBSP WRITE-REPLACE messages. A remote attacker may cause denial of service where they can reach an exposed service that processes this traffic.
mitigation
Restrict network access to services that accept CBSP traffic to trusted peers until an upstream update is available. Apply a vendor-provided fixed release when one is published.
outcome
Contextual, not validated: no deterministic check could cover this one, and no technique passed our review.
source signals
Public signals that triggered or updated the pipeline. These are inputs for the deltas above.
- 2026-10-26 00:00Zcve_org: trigger signal, started the run
this entry in the feed
GET /api/v1/feed/CVE-2026-104592
{ "etk_id": "ETK-2026-2686", "cve_id": "CVE-2026-104592", "display_id": "CVE-2026-104592", "ghsa_id": null, "euvd_id": "EUVD-2026-110100", "status": "published", "anchor_state": "anchored", "title": "Out-of-bounds read in libosmocore CBSP decoder", "summary": "libosmocore versions through 1.14.1 are affected by an out-of-bounds read while processing CBSP WRITE-REPLACE messages. A remote attacker may cause denial of service where they can reach an exposed service that processes this traffic.", "mitigation": "Restrict network access to services that accept CBSP traffic to trusted peers until an upstream update is available. Apply a vendor-provided fixed release when one is published.", "vendor": null, "product": "libosmocore", "affected": [ { "affected_notes": [ "n/a" ], "affected_ranges": [], "ecosystem": null, "fixed_versions": [], "package_name": "n/a", "purl": null } ], "cwes": null, "cvss_score": null, "cvss_src": null, "cvss_vector": null, "epss_score": null, "epss_percentile": null, "epss_asof": null, "automation": "contextual", "check": false, "check_confidence_basis": null, "exploit": false, "pipeline_minutes": 21.9866879, "t0_at": "2026-10-26T00:00:00+00:00", "signals": { "trigger_signal": { "at": "2026-10-26T00:00:00+00:00", "days": 0, "is_lower_bound": false, "measured_at": "2026-10-26T00:00:00+00:00", "url": "https://www.cve.org/CVERecord?id=CVE-2026-104592" } } }
published 2026-10-26 19:52Z
last change 2026-10-26 20:44Z
Need the technical details behind an entry?
Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.