CVE-2023-26076

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-03-13 · updated 2026-06-17
Weakness: CWE-120

Description

An issue was discovered in Samsung Mobile Chipset and Baseband Modem Chipset for Exynos 1280, Exynos 2200, Exynos Modem 5123, Exynos Modem 5300, and Exynos Auto T5123. An intra-object overflow in the 5G SM message codec can occur due to insufficient parameter validation when decoding reserved options.

Affected products

Samsung Exynos 1280 firmware: all versions
Samsung Exynos 2200 Firmware: all versions
Samsung Exynos Auto T5123 Firmware: all versions
Samsung Exynos Modem 5123 Firmware: all versions
Samsung Exynos Modem 5300 Firmware: all versions

References

http://packetstormsecurity.com/files/171400/Shannon-Baseband-NrSmPcoCodec-Intra-Object-Overflow.html
https://googleprojectzero.blogspot.com/2023/03/multiple-internet-to-baseband-remote-rce.html
https://semiconductor.samsung.com/processor/mobile-processor/
https://semiconductor.samsung.com/processor/modem/
https://semiconductor.samsung.com/support/quality-support/product-security-updates/
http://packetstormsecurity.com/files/171400/Shannon-Baseband-NrSmPcoCodec-Intra-Object-Overflow.html
https://googleprojectzero.blogspot.com/2023/03/multiple-internet-to-baseband-remote-rce.html
https://semiconductor.samsung.com/processor/mobile-processor/
https://semiconductor.samsung.com/processor/modem/
https://semiconductor.samsung.com/support/quality-support/product-security-updates/

Get alerted when CVE-2023-26076 or the next vulnerability affects your stack