CVE-2026-104597
Description
A flaw was found in libosmocore. An out-of-bounds read vulnerability in the iuup_rx_initialization function allows a remote attacker to obtain sensitive data. By sending specially crafted initialization network packets, an attacker can cause the application to read memory past the allocated buffer, leading to information disclosure.
Statement
This vulnerability is rated as Moderate impact because an unauthenticated remote attacker could trigger out-of-bounds memory disclosure without the ability to corrupt system memory or cause a denial of service. The affected libosmocore library is not shipped or supported in Red Hat Enterprise Linux or other Red Hat enterprise products, restricting exposure exclusively to Fedora community releases. Exploitation is limited to network services that actively parse incoming IuUP initialization frames, preventing wider impact across general workloads.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
