CVE catalog

CVE-2026-104593

osmo-msc: CVE-2026-104593

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]

osmo-msc through 1.15.0 contains a stack-based buffer overflow in decode_mme_name() in src/libmsc/sgs_iface.c. This allows a remote attacker to cause a denial of service.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianosmo-mscsid1.16.0+dfsg1-2fixed
Debianosmo-mscforky1.16.0+dfsg1-2fixed
Debianosmo-msctrixie1.13.0+dfsg1-2vulnerable
Debianosmo-mscbookworm1.9.0+dfsg1-2vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianosmo-mscsourcesid1.16.0+dfsg1-2not yet assignedNot reportedNot reported
Debianosmo-mscsourceforky1.16.0+dfsg1-2not yet assignedNot reportedNot reported
Debianosmo-mscsourcetrixie(unfixed)not yet assignedNot reportedNot reported
Debianosmo-mscsourcebookworm(unfixed)not yet assignedNot reportedNot reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [osmo-msc]Affected
    Details (2)

    • 1.9.0+dfsg1-2 · amd64 · bookworm

      Affected

      dsa · osmo-msc · debian · bookworm; dsa · osmo-msc · debian · 12

    • 1.9.0+dfsg1-2 · arm64 · bookworm

      Affected

      dsa · osmo-msc · debian · bookworm; dsa · osmo-msc · debian · 12

[Debian 13 (Trixie)]

  • [osmo-msc]Affected
    Details (2)

    • 1.13.0+dfsg1-2 · amd64 · trixie

      Affected

      dsa · osmo-msc · debian · 13

    • 1.13.0+dfsg1-2 · arm64 · trixie

      Affected

      dsa · osmo-msc · debian · 13

Observed:

References

[Debian Security Tracker] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database]