CVE-2026-104596
waiting for further signalsZero needs more public information before it can validate it.description
libosmocore through 1.14.1 is affected by out-of-bounds reads in its GSM 04.80 supplementary-service parsing code. A remote attacker may obtain sensitive information when they can reach an application or service that processes the affected protocol data.
mitigation
Upgrade to a release newer than 1.14.1 after confirming the vendor's fixed version; the advisory does not identify one. Until then, restrict network access to services that expose the affected GSM supplementary-service parsing functionality.
outcome
Contextual, not validated: no deterministic check could cover this one, and no technique passed our review.
source signals
Public signals that triggered or updated the pipeline. These are inputs for the deltas above.
- 2026-10-26 00:00Zcve_org: trigger signal, started the run
this entry in the feed
GET /api/v1/feed/CVE-2026-104596
{ "etk_id": "ETK-2026-2689", "cve_id": "CVE-2026-104596", "display_id": "CVE-2026-104596", "ghsa_id": null, "euvd_id": "EUVD-2026-110097", "status": "published", "anchor_state": "anchored", "title": "Out-of-bounds read in libosmocore GSM supplementary-service parsers", "summary": "libosmocore through 1.14.1 is affected by out-of-bounds reads in its GSM 04.80 supplementary-service parsing code. A remote attacker may obtain sensitive information when they can reach an application or service that processes the affected protocol data.", "mitigation": "Upgrade to a release newer than 1.14.1 after confirming the vendor's fixed version; the advisory does not identify one. Until then, restrict network access to services that expose the affected GSM supplementary-service parsing functionality.", "vendor": null, "product": "libosmocore", "affected": [ { "affected_notes": [ "n/a" ], "affected_ranges": [], "ecosystem": null, "fixed_versions": [], "package_name": "n/a", "purl": null } ], "cwes": null, "cvss_score": null, "cvss_src": null, "cvss_vector": null, "epss_score": null, "epss_percentile": null, "epss_asof": null, "automation": "contextual", "check": false, "check_confidence_basis": null, "exploit": false, "pipeline_minutes": 25.3503196, "t0_at": "2026-10-26T00:00:00+00:00", "signals": { "trigger_signal": { "at": "2026-10-26T00:00:00+00:00", "days": 0, "is_lower_bound": false, "measured_at": "2026-10-26T00:00:00+00:00", "url": "https://www.cve.org/CVERecord?id=CVE-2026-104596" } } }
published 2026-10-26 20:14Z
last change 2026-10-26 21:18Z
Need the technical details behind an entry?
Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.