TI-2026-53127 Aliases CVE-2026-75894 GHSA-g4v5-w6q6-j5cq

Reachable assertion at ranap_handle_co_dt()

LOW 39CWE-617Published 2026-09-18 · Updated 2026-09-21

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-617.

Summary

In osmo-iuh from 0.1.0 through 1.8.0 a reachable assertion was found in the ranap_handle_co_dt() function via a arbitrarily sized NAS-PDU that leads to process crash and remote denial of service.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00314 24th percentileScored 2026-11-07

Fix Fixed osmo-iuh (Osmocom): 1.8.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Osmocom	osmo-iuh	0.1.0 to before 1.8.0	1.8.0	Patch available	CNA

osmo-iuh VendorOsmocom Affected 0.1.0 to before 1.8.0 Fixed in 1.8.0 Patch available CNA

Remediation

Fix · CNA osmo-iuh (Osmocom) Fixed in 1.8.0

Timeline

2026-10-02 Threatist record created from CVE-2026-75894
2026-10-03 Alias added: GHSA-g4v5-w6q6-j5cq

References

Patch 1

https://cgit.osmocom.org/osmo-iuh/commit/?id=f06967126f486bcb185ccf3d1a8f9bc02c4da1f6

TI-2026-53128 Out of bounds read at smpp34_unpack() CVSS 3.1HIGH 7.5
TI-2026-53126 Heap based buffer overflow at ipaccess_proxy_read_msg() CVSS 3.1HIGH 7.5
TI-2026-53125 Out of bounds write in PDP ctx GSN-Address decode CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences