A stack-based buffer overflow exists in the decode_mme_name() function of osmo-msc. The flaw allows an attacker to supply a crafted input that overflows a local buffer, causing the process to crash and resulting in a denial of service. No evidence of code execution or information disclosure is provided in the description, so the primary consequence is service interruption. The likely attack vector is remote, inferred from the description that a remote attacker can trigger the DoS without needing local access.

Versions of osmo-msc up to and including 1.15.0 are affected. The vulnerable code resides in src/libmsc/sgs_iface.c and is present in all releases prior to the 1.15.1 update. The product is developed and maintained by osmocom.

The CVSS score is not listed, but the EPSS score is unavailable and the vulnerability is not present in the CISA KEV catalog, indicating no known public exploitation. Nevertheless, a remote attacker with network visibility could exploit the overflow to repeatedly crash the service, causing downtime. Because the flaw is a stack-based buffer overflow (CWE‑119), an attacker might attempt multiple connections to trigger the crash until successful. The risk is moderate: the impact is limited to service availability, but it can have operational consequences if the service is critical. The attack would typically require network-level access to the osmo-msc instance.