Libosmocore versions through 1.14.1 contain an out‑of‑bounds read in the IPA CCM identity‑tag parsers located in src/gsm/ipa.c. A remote attacker can trigger the parsing routine and read memory beyond the intended buffer, potentially exposing sensitive data that resides in process memory.

The flaw is present in all releases of libosmocore up to and including 1.14.1. Any system that compiles or links against this library for GSM baseband processing—such as software‑defined radio gateways or embedded mobile network infrastructure—may be affected.

The vulnerability is remotely exploitable via network traffic that invokes the IPA CCM identity‑tag parser. No CVSS score or EPSS metric is available, and the flaw is not listed in the CISA KEV catalog. An attacker needs only to send crafted protocol messages to trigger the out‑of‑bounds read, so the risk level is considered high given the potential for sensitive data disclosure.