High · 7.5 CVE-2026-104598 EUVD-2026-110095GHSA-wjvp-f88x-8jqw

libosmo-sigtran through 2.2.1 contains an out-of-bounds read in the M3UA NOTIFY decoder in src/m3ua.c. This allows a remote attacker to obt…

Published Oct 26, 2026 · Updated Nov 2, 2026 · Assigned by mitre

Package: libosmo-sigtran Package: libosmo-sigtran Ecosystem: Debian Ecosystem: Ubuntu

Description

libosmo-sigtran through 2.2.1 contains an out-of-bounds read in the M3UA NOTIFY decoder in src/m3ua.c. This allows a remote attacker to obtain sensitive information.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	libosmo-sigtran	2.3.0-1	—
Debian 13	libosmo-sigtran	No fix yet	—

Ubuntu