CVE-2026-75893: osmo-bsc Buffer Overflow Vulnerability

CVE-2026-75893 Overview

CVE-2026-75893 is a heap-based buffer overflow in the osmo-bsc component of the Osmocom cellular network stack. The flaw resides in the ipaccess_proxy_read_msg() function and is triggered through crafted IPA (IP Access) frame lengths. Versions 1.0.1 through 1.14.1 of osmo-bsc are affected. The weakness is classified as [CWE-122] Heap-based Buffer Overflow. A remote, unauthenticated attacker able to reach the IPA proxy interface can send malformed frames that corrupt heap memory and crash the process, disrupting Base Station Controller (BSC) operations in GSM networks.

Critical Impact
Remote, unauthenticated attackers can trigger a heap-based buffer overflow in the IPA proxy, causing denial of service against the osmo-bsc Base Station Controller.

Affected Products

Osmocom osmo-bsc version 1.0.1
Osmocom osmo-bsc versions 1.1.0 through 1.13.x
Osmocom osmo-bsc version 1.14.1

Discovery Timeline

2026-09-18 - CVE-2026-75893 published to NVD
2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-75893

Vulnerability Analysis

The defect is a heap-based buffer overflow inside ipaccess_proxy_read_msg(), the routine that parses inbound IPA protocol frames handled by the osmo-bsc IPA proxy. IPA frames carry a length field in their header that indicates how many payload bytes follow. When the function reads a frame, it uses this attacker-controlled length to size or index a heap allocation without adequately validating the value against the actual buffer capacity.

Because the parser trusts the wire-supplied length, an oversized or malformed length field causes bytes to be written beyond the allocated heap region. The corruption reliably crashes the daemon, and, depending on heap layout, may overwrite adjacent allocations. Successful exploitation targets availability of the BSC, which is a central node in a GSM radio access network.

Root Cause

The root cause is missing bounds validation on the IPA frame length field before it is used to drive a memory copy in ipaccess_proxy_read_msg(). The upstream fix is published in the Osmocom repository at OsmoCom Commit 2852a03c.

Attack Vector

Exploitation requires network reachability to the IPA proxy port exposed by osmo-bsc. No authentication or user interaction is required. An attacker sends a single crafted IPA frame with a manipulated length header. The osmo-bsc process reads the frame, mishandles the length, and corrupts heap memory. In production GSM deployments, this interrupts call setup, handover, and control-plane signaling between BTS units and the core network.

Refer to the upstream commit at OsmoCom Commit 2852a03c for the exact parser changes.

Detection Methods for CVE-2026-75893

Indicators of Compromise

Unexpected termination or repeated restarts of the osmo-bsc process, particularly under systemd supervision.
Core dumps or segmentation faults referencing ipaccess_proxy_read_msg in stack traces.
Inbound IPA frames on the proxy listener with length header values that exceed reasonable IPA payload sizes.

Detection Strategies

Inspect network traffic to the IPA proxy port and alert on frames whose declared length is inconsistent with the actual TCP segment payload.
Correlate osmo-bsc crash events with preceding TCP connections from unexpected source addresses on the IPA interface.
Deploy an IDS signature that flags IPA frames with abnormally large length fields directed at Osmocom BSC hosts.

Monitoring Recommendations

Monitor process health of osmo-bsc and forward crash telemetry, journal entries, and core dumps to a central log platform.
Baseline the source addresses that legitimately speak IPA to the BSC and alert on any deviation.
Track version inventory of Osmocom components to confirm no host is running osmo-bsc in the vulnerable 1.0.1 to 1.14.1 range.

How to Mitigate CVE-2026-75893

Immediate Actions Required

Upgrade osmo-bsc to a release that includes the fix from OsmoCom Commit 2852a03c.
Restrict network access to the IPA proxy port to trusted BTS management addresses only.
Enable automatic restart of the osmo-bsc service to reduce outage duration if a crash occurs during patch rollout.

Patch Information

The upstream fix is committed to the Osmocom osmo-bsc repository. Operators should rebuild or update packages to a version that incorporates commit 2852a03c153cd9418c2a86d0b2193ac41169dbb7. Reference: OsmoCom Commit Update.

Workarounds

Place the IPA proxy behind a firewall or VPN that restricts access to authenticated BTS peers.
Segment the signaling network so that only known Osmocom nodes can reach the IPA port on the BSC.
If the IPA proxy feature is not used in the deployment, disable it in the osmo-bsc configuration until the patched version is installed.

bash

# Configuration example: restrict IPA proxy access at the host firewall
# Replace <IPA_PORT> with the port osmo-bsc listens on and <TRUSTED_BTS_CIDR> with your BTS subnet
iptables -A INPUT -p tcp --dport <IPA_PORT> -s <TRUSTED_BTS_CIDR> -j ACCEPT
iptables -A INPUT -p tcp --dport <IPA_PORT> -j DROP