CVE-2026-75895: libsmpp35 Buffer Overflow Vulnerability

CVE-2026-75895 Overview

CVE-2026-75895 is an out-of-bounds read vulnerability in the libsmpp34 library (also referenced as libsmpp35), affecting versions 0.1.0 through 1.8.0. The flaw resides in the smpp34_unpack() function, which processes Short Message Peer-to-Peer (SMPP) Protocol Data Units (PDUs). An attacker can supply crafted SMPP PDUs to trigger memory corruption through reads beyond allocated buffer boundaries. The vulnerability is classified under CWE-125 (Out-of-bounds Read).

Critical Impact
Network-adjacent attackers can send malicious SMPP PDUs to SMSC or ESME implementations using vulnerable versions of libsmpp34, causing memory corruption and potential disclosure of adjacent memory contents.

Affected Products

libsmpp34 version 0.1.0 through 1.8.0
OsmoCom libsmpp34 library (upstream project)
Applications and SMSC/ESME gateways linking against affected libsmpp34 versions

Discovery Timeline

2026-09-18 - CVE-2026-75895 published to the National Vulnerability Database (NVD)
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-75895

Vulnerability Analysis

The libsmpp34 library implements packing and unpacking routines for the SMPP protocol, which telecom operators use to exchange short messages between Short Message Service Centers (SMSCs) and External Short Messaging Entities (ESMEs). The vulnerable smpp34_unpack() function reads PDU fields from a network-supplied buffer without correctly validating that the declared field lengths remain within the bounds of the received data.

When an attacker submits a malformed PDU with manipulated length or offset fields, smpp34_unpack() continues to dereference memory past the end of the input buffer. This exposes adjacent heap or stack contents and can corrupt internal parsing state. The impact is limited to confidentiality according to the CVSS vector, reflecting information disclosure rather than direct code execution.

Root Cause

The root cause is missing bounds validation during PDU deserialization. smpp34_unpack() trusts length descriptors embedded in the incoming SMPP PDU when advancing its read cursor across the input buffer. Because SMPP PDUs are attacker-controlled at the network boundary, malformed field descriptors force the parser to read outside allocated memory, satisfying the CWE-125 classification.

Attack Vector

Exploitation requires the attacker to deliver a crafted SMPP PDU to a service that processes traffic with libsmpp34. No authentication or user interaction is required to reach the vulnerable code path in typical deployments where the library ingests session data. Vulnerable services include SMSC gateways, SMPP proxies, and ESME clients that accept inbound SMPP connections. Refer to the OsmoCom commit for the specific parsing paths that were corrected.

Detection Methods for CVE-2026-75895

Indicators of Compromise

Unexpected process crashes or segmentation faults in binaries linked against libsmpp34
SMPP sessions containing PDUs with length fields that exceed the received TCP segment size
Repeated malformed submit_sm, deliver_sm, or bind_transceiver PDUs from a single source

Detection Strategies

Deploy protocol-aware inspection on SMPP ports (default TCP 2775) to flag PDUs where the command_length header disagrees with actual payload size
Monitor host telemetry for crashes and abnormal exits of processes that link libsmpp34
Correlate inbound SMPP session anomalies with downstream memory faults using a centralized data lake

Monitoring Recommendations

Enable verbose logging on SMPP gateways to capture malformed PDU rejections and parser errors
Alert on repeated TCP resets or connection terminations from SMPP peers during PDU decoding
Track outbound memory contents in error responses that may indicate information disclosure

How to Mitigate CVE-2026-75895

Immediate Actions Required

Inventory all systems and applications that link against libsmpp34 versions 0.1.0 through 1.8.0
Apply the upstream fix from the OsmoCom commit or upgrade to a patched release
Restrict inbound SMPP connectivity to trusted peers using firewall access control lists

Patch Information

The upstream OsmoCom project addressed the out-of-bounds read in commit af0e2912057551dab97bbe26e6a41f18a75f3bbb. Rebuild libsmpp34 from source with the patched revision, then relink and redeploy dependent binaries. See the OsmoCom commit reference for the exact code changes to smpp34_unpack().

Workarounds

Terminate SMPP sessions in a hardened proxy that validates command_length and field boundaries before forwarding PDUs to libsmpp34
Enforce IP allowlisting so only known SMPP peers can reach the vulnerable service
Run affected daemons under strict sandboxing or seccomp filters to limit the blast radius of memory corruption

bash

# Configuration example: restrict SMPP access with iptables
iptables -A INPUT -p tcp --dport 2775 -s <trusted_peer_ip> -j ACCEPT
iptables -A INPUT -p tcp --dport 2775 -j DROP