A buffer overflow exists in the function osmo_iuup_compute_payload_crc() within libosmocore's IUUP handling. The overflow occurs when processing malformed input, allowing an attacker to corrupt memory and cause the software to crash. This crash results in a denial of service for legitimate users.

The vulnerability affects libosmocore versions up to and including 1.14.1. Systems that compile or use this library without updating beyond 1.14.1 are potentially compromised. Applications in telecom infrastructure that rely on OSMO core components fall into this category.

The CVSS score is not provided, and the EPSS score is unavailable, indicating limited publicly known exploitation data. The issue is not listed in CISA KEV. The overflow can be triggered remotely through malformed IUUP packets, implying that an attacker with network-level access to the affected service could potentially exploit it. The description does not specify authentication requirements, so based on the description it is inferred that no authentication is required, though this is not explicitly documented. The impact is a denial of service, potentially disrupting network operations. Prompt patching or mitigation is recommended.