CVE-2023-30738

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-10-04 · updated 2026-06-17

Description

An improper input validation in UEFI Firmware prior to Firmware update Oct-2023 Release in Galaxy Book, Galaxy Book Pro, Galaxy Book Pro 360 and Galaxy Book Odyssey allows local attacker to execute SMM memory corruption.

Affected products

Samsung Galaxy Book Firmware: before oct-2023 — fixed in oct-2023
Samsung Galaxy Book Odyssey Firmware: before oct-2023 — fixed in oct-2023
Samsung Galaxy Book Pro 360 Firmware: before oct-2023 — fixed in oct-2023
Samsung Galaxy Book Pro Firmware: before oct-2023 — fixed in oct-2023

How to fix

Upgrade to a fixed version: Samsung Galaxy Book Firmware oct-2023; Samsung Galaxy Book Odyssey Firmware oct-2023; Samsung Galaxy Book Pro 360 Firmware oct-2023; Samsung Galaxy Book Pro Firmware oct-2023. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-30738 or the next vulnerability affects your stack