Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    8 vulnerabilities by Osmocom

    CVE-2026-75895 (GCVE-0-2026-75895)

    Vulnerability from nvd – Published: 2026-09-18 19:01 – Updated: 2026-09-18 19:01
    VLAI
    Title
    Out of bounds read at smpp34_unpack()
    Summary
    In libsmpp35 from 0.1.0 through 1.8.0 out of bound read issue was found in the at smpp34_unpack() function via attacker controlled SMPP PDUs, leading to memory corruption.
    Severity
    No CVSS data available.
    CWE
    Assigner
    References
    Impacted products
    Vendor Product Version
    Osmocom libsmpp34 Affected: 1.10.0 , < 1.14.5 (semver)
    		Create a notification for this product.
    Credits
    Nikolas Null "n0k0" - Security Researcher at mnemonic
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "libsmpp34",
          "repo": "https://cgit.osmocom.org/libsmpp34/",
          "vendor": "Osmocom",
          "versions": [
            {
              "lessThan": "1.14.5",
              "status": "affected",
              "version": "1.10.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Nikolas Null \"n0k0\" - Security Researcher at mnemonic"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "In libsmpp35 from 0.1.0 through 1.8.0 out of bound read issue was found in the\u0026nbsp;at smpp34_unpack() function via attacker controlled\u0026nbsp;SMPP PDUs, leading to memory corruption."
            }
          ],
          "value": "In libsmpp35 from 0.1.0 through 1.8.0 out of bound read issue was found in the\u00a0at smpp34_unpack() function via attacker controlled\u00a0SMPP PDUs, leading to memory corruption."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125 Out-of-bounds read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T19:01:34.027Z",
        "orgId": "74b3a70d-cca6-4d34-9789-e83b222ae3be",
        "shortName": "redhat-cnalr"
      },
      "references": [
        {
          "tags": [
            "patch",
            "mitigation"
          ],
          "url": "https://cgit.osmocom.org/libsmpp34/commit/?id=af0e2912057551dab97bbe26e6a41f18a75f3bbb"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Out of bounds read at smpp34_unpack()",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "74b3a70d-cca6-4d34-9789-e83b222ae3be",
    "assignerShortName": "redhat-cnalr",
    "cveId": "CVE-2026-75895",
    "datePublished": "2026-09-18T19:01:34.027Z",
    "dateReserved": "2026-08-18T14:04:08.775Z",
    "dateUpdated": "2026-09-18T19:01:34.027Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-75894 (GCVE-0-2026-75894)

    Vulnerability from nvd – Published: 2026-09-18 18:52 – Updated: 2026-09-18 18:58
    VLAI
    Title
    Reachable assertion at ranap_handle_co_dt()
    Summary
    In osmo-iuh from 0.1.0 through 1.8.0 a reachable assertion was found in the ranap_handle_co_dt() function via a arbitrarily sized NAS-PDU that leads to process crash and remote denial of service.
    Severity
    No CVSS data available.
    CWE
    Assigner
    References
    Impacted products
    Vendor Product Version
    Osmocom osmo-iuh Affected: 0.1.0 , < 1.8.0 (semver)
    		Create a notification for this product.
    Credits
    Nikolas Null "n0k0" - Security Researcher at mnemonic
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "osmo-iuh",
          "repo": "https://cgit.osmocom.org/osmo-iuh/",
          "vendor": "Osmocom",
          "versions": [
            {
              "lessThan": "1.8.0",
              "status": "affected",
              "version": "0.1.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Nikolas Null \"n0k0\" - Security Researcher at mnemonic"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "In osmo-iuh from 0.1.0 through 1.8.0 a reachable assertion was found in the\u0026nbsp;ranap_handle_co_dt() function via a arbitrarily sized\u0026nbsp;NAS-PDU that leads to process crash and remote denial of service."
            }
          ],
          "value": "In osmo-iuh from 0.1.0 through 1.8.0 a reachable assertion was found in the\u00a0ranap_handle_co_dt() function via a arbitrarily sized\u00a0NAS-PDU that leads to process crash and remote denial of service."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-617",
              "description": "CWE-617 Reachable assertion",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T18:58:16.503Z",
        "orgId": "74b3a70d-cca6-4d34-9789-e83b222ae3be",
        "shortName": "redhat-cnalr"
      },
      "references": [
        {
          "tags": [
            "patch",
            "mitigation"
          ],
          "url": "https://cgit.osmocom.org/osmo-iuh/commit/?id=f06967126f486bcb185ccf3d1a8f9bc02c4da1f6"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Reachable assertion at ranap_handle_co_dt()",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "74b3a70d-cca6-4d34-9789-e83b222ae3be",
    "assignerShortName": "redhat-cnalr",
    "cveId": "CVE-2026-75894",
    "datePublished": "2026-09-18T18:52:55.206Z",
    "dateReserved": "2026-08-18T14:04:08.775Z",
    "dateUpdated": "2026-09-18T18:58:16.503Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-75893 (GCVE-0-2026-75893)

    Vulnerability from nvd – Published: 2026-09-18 18:40 – Updated: 2026-09-18 18:40
    VLAI
    Title
    Heap based buffer overflow at ipaccess_proxy_read_msg()
    Summary
    In osmo-bsc from 1.0.1 through 1.14.1 a heap based buffer overflow issue was found in the ipaccess_proxy_read_msg()  function via IPA frame lengths.
    Severity
    No CVSS data available.
    CWE
    • CWE-122 - Heap-based buffer overflow
    Assigner
    References
    Impacted products
    Vendor Product Version
    Osmocom osmo-bsc Affected: 1.0.1 , < 1.14.1 (semver)
    		Create a notification for this product.
    Credits
    Nikolas Null "n0k0" - Security Researcher at mnemonic
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "osmo-bsc",
          "repo": "https://cgit.osmocom.org/osmo-bsc/",
          "vendor": "Osmocom",
          "versions": [
            {
              "lessThan": "1.14.1",
              "status": "affected",
              "version": "1.0.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Nikolas Null \"n0k0\" - Security Researcher at mnemonic"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "In osmo-bsc from 1.0.1 through 1.14.1 a heap based buffer overflow issue was found in the\u0026nbsp;ipaccess_proxy_read_msg()\u0026nbsp; function via\u0026nbsp;IPA frame lengths."
            }
          ],
          "value": "In osmo-bsc from 1.0.1 through 1.14.1 a heap based buffer overflow issue was found in the\u00a0ipaccess_proxy_read_msg()\u00a0 function via\u00a0IPA frame lengths."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-122",
              "description": "CWE-122 Heap-based buffer overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T18:40:26.578Z",
        "orgId": "74b3a70d-cca6-4d34-9789-e83b222ae3be",
        "shortName": "redhat-cnalr"
      },
      "references": [
        {
          "tags": [
            "patch",
            "mitigation"
          ],
          "url": "https://cgit.osmocom.org/osmo-bsc/commit/?id=2852a03c153cd9418c2a86d0b2193ac41169dbb7"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Heap based buffer overflow at ipaccess_proxy_read_msg()",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "74b3a70d-cca6-4d34-9789-e83b222ae3be",
    "assignerShortName": "redhat-cnalr",
    "cveId": "CVE-2026-75893",
    "datePublished": "2026-09-18T18:40:26.578Z",
    "dateReserved": "2026-08-18T14:04:08.775Z",
    "dateUpdated": "2026-09-18T18:40:26.578Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-75892 (GCVE-0-2026-75892)

    Vulnerability from nvd – Published: 2026-09-18 18:30 – Updated: 2026-09-18 18:37
    VLAI
    Title
    Out of bounds write in PDP ctx GSN-Address decode
    Summary
    In osmo-ggsn 1.14.0 an out of bounds write issue was found in the gtp_decode_pdp_ctx() function through the PDP context GSN-Address sub-field, leading to memory corruption.
    Severity
    No CVSS data available.
    CWE
    Assigner
    References
    Impacted products
    Vendor Product Version
    Osmocom osmo-ggsn Affected: 1.14.0 (semver)
    		Create a notification for this product.
    Credits
    Nikolas Null "n0k0" - Security Researcher at mnemonic
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "osmo-ggsn",
          "repo": "https://cgit.osmocom.org/osmo-ggsn/",
          "vendor": "Osmocom",
          "versions": [
            {
              "status": "affected",
              "version": "1.14.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Nikolas Null \"n0k0\" - Security Researcher at mnemonic"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "In osmo-ggsn 1.14.0 an out of bounds write issue was found in the\u0026nbsp;gtp_decode_pdp_ctx() function through the PDP context GSN-Address sub-field, leading to memory corruption."
            }
          ],
          "value": "In osmo-ggsn 1.14.0 an out of bounds write issue was found in the\u00a0gtp_decode_pdp_ctx() function through the PDP context GSN-Address sub-field, leading to memory corruption."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "CWE-787 Out-of-bounds write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T18:37:36.605Z",
        "orgId": "74b3a70d-cca6-4d34-9789-e83b222ae3be",
        "shortName": "redhat-cnalr"
      },
      "references": [
        {
          "tags": [
            "patch",
            "mitigation"
          ],
          "url": "https://cgit.osmocom.org/osmo-ggsn/commit/?id=6c322f4dd339401a437da3c89c95f2bf64bca995"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Out of bounds write in PDP ctx GSN-Address decode",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "74b3a70d-cca6-4d34-9789-e83b222ae3be",
    "assignerShortName": "redhat-cnalr",
    "cveId": "CVE-2026-75892",
    "datePublished": "2026-09-18T18:30:31.298Z",
    "dateReserved": "2026-08-18T14:04:08.775Z",
    "dateUpdated": "2026-09-18T18:37:36.605Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-75895 (GCVE-0-2026-75895)

    Vulnerability from cvelistv5 – Published: 2026-09-18 19:01 – Updated: 2026-09-18 19:01
    VLAI
    Title
    Out of bounds read at smpp34_unpack()
    Summary
    In libsmpp35 from 0.1.0 through 1.8.0 out of bound read issue was found in the at smpp34_unpack() function via attacker controlled SMPP PDUs, leading to memory corruption.
    Severity
    No CVSS data available.
    CWE
    Assigner
    References
    Impacted products
    Vendor Product Version
    Osmocom libsmpp34 Affected: 1.10.0 , < 1.14.5 (semver)
    		Create a notification for this product.
    Credits
    Nikolas Null "n0k0" - Security Researcher at mnemonic
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "libsmpp34",
          "repo": "https://cgit.osmocom.org/libsmpp34/",
          "vendor": "Osmocom",
          "versions": [
            {
              "lessThan": "1.14.5",
              "status": "affected",
              "version": "1.10.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Nikolas Null \"n0k0\" - Security Researcher at mnemonic"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "In libsmpp35 from 0.1.0 through 1.8.0 out of bound read issue was found in the\u0026nbsp;at smpp34_unpack() function via attacker controlled\u0026nbsp;SMPP PDUs, leading to memory corruption."
            }
          ],
          "value": "In libsmpp35 from 0.1.0 through 1.8.0 out of bound read issue was found in the\u00a0at smpp34_unpack() function via attacker controlled\u00a0SMPP PDUs, leading to memory corruption."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125 Out-of-bounds read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T19:01:34.027Z",
        "orgId": "74b3a70d-cca6-4d34-9789-e83b222ae3be",
        "shortName": "redhat-cnalr"
      },
      "references": [
        {
          "tags": [
            "patch",
            "mitigation"
          ],
          "url": "https://cgit.osmocom.org/libsmpp34/commit/?id=af0e2912057551dab97bbe26e6a41f18a75f3bbb"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Out of bounds read at smpp34_unpack()",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "74b3a70d-cca6-4d34-9789-e83b222ae3be",
    "assignerShortName": "redhat-cnalr",
    "cveId": "CVE-2026-75895",
    "datePublished": "2026-09-18T19:01:34.027Z",
    "dateReserved": "2026-08-18T14:04:08.775Z",
    "dateUpdated": "2026-09-18T19:01:34.027Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-75894 (GCVE-0-2026-75894)

    Vulnerability from cvelistv5 – Published: 2026-09-18 18:52 – Updated: 2026-09-18 18:58
    VLAI
    Title
    Reachable assertion at ranap_handle_co_dt()
    Summary
    In osmo-iuh from 0.1.0 through 1.8.0 a reachable assertion was found in the ranap_handle_co_dt() function via a arbitrarily sized NAS-PDU that leads to process crash and remote denial of service.
    Severity
    No CVSS data available.
    CWE
    Assigner
    References
    Impacted products
    Vendor Product Version
    Osmocom osmo-iuh Affected: 0.1.0 , < 1.8.0 (semver)
    		Create a notification for this product.
    Credits
    Nikolas Null "n0k0" - Security Researcher at mnemonic
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "osmo-iuh",
          "repo": "https://cgit.osmocom.org/osmo-iuh/",
          "vendor": "Osmocom",
          "versions": [
            {
              "lessThan": "1.8.0",
              "status": "affected",
              "version": "0.1.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Nikolas Null \"n0k0\" - Security Researcher at mnemonic"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "In osmo-iuh from 0.1.0 through 1.8.0 a reachable assertion was found in the\u0026nbsp;ranap_handle_co_dt() function via a arbitrarily sized\u0026nbsp;NAS-PDU that leads to process crash and remote denial of service."
            }
          ],
          "value": "In osmo-iuh from 0.1.0 through 1.8.0 a reachable assertion was found in the\u00a0ranap_handle_co_dt() function via a arbitrarily sized\u00a0NAS-PDU that leads to process crash and remote denial of service."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-617",
              "description": "CWE-617 Reachable assertion",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T18:58:16.503Z",
        "orgId": "74b3a70d-cca6-4d34-9789-e83b222ae3be",
        "shortName": "redhat-cnalr"
      },
      "references": [
        {
          "tags": [
            "patch",
            "mitigation"
          ],
          "url": "https://cgit.osmocom.org/osmo-iuh/commit/?id=f06967126f486bcb185ccf3d1a8f9bc02c4da1f6"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Reachable assertion at ranap_handle_co_dt()",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "74b3a70d-cca6-4d34-9789-e83b222ae3be",
    "assignerShortName": "redhat-cnalr",
    "cveId": "CVE-2026-75894",
    "datePublished": "2026-09-18T18:52:55.206Z",
    "dateReserved": "2026-08-18T14:04:08.775Z",
    "dateUpdated": "2026-09-18T18:58:16.503Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-75893 (GCVE-0-2026-75893)

    Vulnerability from cvelistv5 – Published: 2026-09-18 18:40 – Updated: 2026-09-18 18:40
    VLAI
    Title
    Heap based buffer overflow at ipaccess_proxy_read_msg()
    Summary
    In osmo-bsc from 1.0.1 through 1.14.1 a heap based buffer overflow issue was found in the ipaccess_proxy_read_msg()  function via IPA frame lengths.
    Severity
    No CVSS data available.
    CWE
    • CWE-122 - Heap-based buffer overflow
    Assigner
    References
    Impacted products
    Vendor Product Version
    Osmocom osmo-bsc Affected: 1.0.1 , < 1.14.1 (semver)
    		Create a notification for this product.
    Credits
    Nikolas Null "n0k0" - Security Researcher at mnemonic
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "osmo-bsc",
          "repo": "https://cgit.osmocom.org/osmo-bsc/",
          "vendor": "Osmocom",
          "versions": [
            {
              "lessThan": "1.14.1",
              "status": "affected",
              "version": "1.0.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Nikolas Null \"n0k0\" - Security Researcher at mnemonic"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "In osmo-bsc from 1.0.1 through 1.14.1 a heap based buffer overflow issue was found in the\u0026nbsp;ipaccess_proxy_read_msg()\u0026nbsp; function via\u0026nbsp;IPA frame lengths."
            }
          ],
          "value": "In osmo-bsc from 1.0.1 through 1.14.1 a heap based buffer overflow issue was found in the\u00a0ipaccess_proxy_read_msg()\u00a0 function via\u00a0IPA frame lengths."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-122",
              "description": "CWE-122 Heap-based buffer overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T18:40:26.578Z",
        "orgId": "74b3a70d-cca6-4d34-9789-e83b222ae3be",
        "shortName": "redhat-cnalr"
      },
      "references": [
        {
          "tags": [
            "patch",
            "mitigation"
          ],
          "url": "https://cgit.osmocom.org/osmo-bsc/commit/?id=2852a03c153cd9418c2a86d0b2193ac41169dbb7"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Heap based buffer overflow at ipaccess_proxy_read_msg()",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "74b3a70d-cca6-4d34-9789-e83b222ae3be",
    "assignerShortName": "redhat-cnalr",
    "cveId": "CVE-2026-75893",
    "datePublished": "2026-09-18T18:40:26.578Z",
    "dateReserved": "2026-08-18T14:04:08.775Z",
    "dateUpdated": "2026-09-18T18:40:26.578Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-75892 (GCVE-0-2026-75892)

    Vulnerability from cvelistv5 – Published: 2026-09-18 18:30 – Updated: 2026-09-18 18:37
    VLAI
    Title
    Out of bounds write in PDP ctx GSN-Address decode
    Summary
    In osmo-ggsn 1.14.0 an out of bounds write issue was found in the gtp_decode_pdp_ctx() function through the PDP context GSN-Address sub-field, leading to memory corruption.
    Severity
    No CVSS data available.
    CWE
    Assigner
    References
    Impacted products
    Vendor Product Version
    Osmocom osmo-ggsn Affected: 1.14.0 (semver)
    		Create a notification for this product.
    Credits
    Nikolas Null "n0k0" - Security Researcher at mnemonic
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "osmo-ggsn",
          "repo": "https://cgit.osmocom.org/osmo-ggsn/",
          "vendor": "Osmocom",
          "versions": [
            {
              "status": "affected",
              "version": "1.14.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Nikolas Null \"n0k0\" - Security Researcher at mnemonic"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "In osmo-ggsn 1.14.0 an out of bounds write issue was found in the\u0026nbsp;gtp_decode_pdp_ctx() function through the PDP context GSN-Address sub-field, leading to memory corruption."
            }
          ],
          "value": "In osmo-ggsn 1.14.0 an out of bounds write issue was found in the\u00a0gtp_decode_pdp_ctx() function through the PDP context GSN-Address sub-field, leading to memory corruption."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "CWE-787 Out-of-bounds write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T18:37:36.605Z",
        "orgId": "74b3a70d-cca6-4d34-9789-e83b222ae3be",
        "shortName": "redhat-cnalr"
      },
      "references": [
        {
          "tags": [
            "patch",
            "mitigation"
          ],
          "url": "https://cgit.osmocom.org/osmo-ggsn/commit/?id=6c322f4dd339401a437da3c89c95f2bf64bca995"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Out of bounds write in PDP ctx GSN-Address decode",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "74b3a70d-cca6-4d34-9789-e83b222ae3be",
    "assignerShortName": "redhat-cnalr",
    "cveId": "CVE-2026-75892",
    "datePublished": "2026-09-18T18:30:31.298Z",
    "dateReserved": "2026-08-18T14:04:08.775Z",
    "dateUpdated": "2026-09-18T18:37:36.605Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}