[Debian-mobcom-maintainers] Bug#1148557: libsmpp34: CVE-2026-75895

[Moritz Mühlenhoff]

Source: libsmpp34
X-Debbugs-CC: team at security.debian.org
Severity: important
Tags: security

Hi,

The following vulnerability was published for libsmpp34.

CVE-2026-75895[0]:
| In libsmpp35 from 0.1.0 through 1.8.0 out of bound read issue was
| found in the at smpp34_unpack() function via attacker
| controlled SMPP PDUs, leading to memory corruption.

https://cgit.osmocom.org/libsmpp34/commit/?id=af0e2912057551dab97bbe26e6a41f18a75f3bbb


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-75895
    https://www.cve.org/CVERecord?id=CVE-2026-75895

Please adjust the affected versions in the BTS as needed.