libosmo-sigtran 2.2.1 and earlier contain an out-of-bounds read in the M3UA NOTIFY decoder located in src/m3ua.c. This flaw allows a remote attacker to trigger an over‑read and obtain sensitive data from memory. The vulnerability does not provide code execution or denial‑of‑service capability; it potentially exposes confidential information only. The fault arises from improper bounds checking when processing M3UA NOTIFY messages, so the attacker must supply malformed traffic over the control‑plane interface.

The affected product is libosmo-sigtran, a library used in the Osmocom signaling stack. All releases up to and including 2.2.1 are impacted. The patch referenced in the official commit (b554131f2cbb20ca9a9cf51ca17d73f644eff1f8) addresses the buffer over‑read by adding necessary bounds checks before accessing the message payload.

Exploitability requires remote delivery of a crafted M3UA NOTIFY message, meaning an attacker must be able to reach the M3UA interface over the network. Because the vulnerability is an out‑of‑bounds read, successful execution would reveal internal data but not allow further control. The EPSS score is unavailable, and KEV lists it as not exploited, indicating no public exploitation yet. However, given the potential for sensitive data leakage, the risk remains significant for organizations exposing M3UA services.