libosmocore contains an out‐of‐bounds read in the CBSP WRITE‑REPLACE decoder that can be exploited remotely to crash the process and trigger a service interruption. The flaw does not provide code execution or data disclosure; its primary effect is the loss of availability of components that rely on libosmocore for CBSP processing.

Applications that use libosmocore up to and including version 1.14.1 are affected, regardless of the vendor or product that embeds the library.

The vulnerability has no published CVSS score and its EPSS information is unavailable, but the lack of protection around the buffer limits implies a low technical effort for exploitation. A remote attacker can likely trigger the fault by sending a malformed CBSP WRITE‑REPLACE packet over the network to any service that uses the vulnerable libosmocore library. The vulnerability is listed in CISA KEV as not present, yet its impact on availability makes it a priority for remediation.