CVE-2023-26076
Status: ModifiedCritical (9.8)—
An issue was discovered in Samsung Mobile Chipset and Baseband Modem Chipset for Exynos 1280, Exynos 2200, Exynos Modem 5123, Exynos Modem 5300, and Exynos Auto T5123. An intra-object overflow in the 5G SM message codec can occur due to insufficient parameter validation when decoding reserved options.
CVSS
- Version: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Base score: 9.8
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days: 0.93%
- Percentile among all scored CVEs: 59
- Score date: 10/6/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
Affected technologies (5)
CWEs
- CWE-120
- CWE-120
References
- http://packetstormsecurity.com/files/171400/Shannon-Baseband-NrSmPcoCodec-Intra-Object-Overflow.html
- https://googleprojectzero.blogspot.com/2023/03/multiple-internet-to-baseband-remote-rce.html
- https://semiconductor.samsung.com/processor/mobile-processor/
- https://semiconductor.samsung.com/processor/modem/
- https://semiconductor.samsung.com/support/quality-support/product-security-updates/
- http://packetstormsecurity.com/files/171400/Shannon-Baseband-NrSmPcoCodec-Intra-Object-Overflow.html
- https://googleprojectzero.blogspot.com/2023/03/multiple-internet-to-baseband-remote-rce.html
- https://semiconductor.samsung.com/processor/mobile-processor/
- https://semiconductor.samsung.com/processor/modem/
- https://semiconductor.samsung.com/support/quality-support/product-security-updates/
Raw JSON (NVD)
Show
{
"id": "CVE-2023-26076",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2023-26076",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2025-03-03T18:06:35.802458Z"
}
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "cve@mitre.org",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.6,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H",
"integrityImpact": "LOW",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "LOW"
},
"impactScore": 4.7,
"exploitabilityScore": 2.8
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 9.8,
"attackVector": "NETWORK",
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 3.9
}
]
},
"affected": [
{
"source": "cve@mitre.org",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2023-03-13T15:15:12.720",
"references": [
{
"url": "http://packetstormsecurity.com/files/171400/Shannon-Baseband-NrSmPcoCodec-Intra-Object-Overflow.html",
"source": "cve@mitre.org"
},
{
"url": "https://googleprojectzero.blogspot.com/2023/03/multiple-internet-to-baseband-remote-rce.html",
"source": "cve@mitre.org"
},
{
"url": "https://semiconductor.samsung.com/processor/mobile-processor/",
"tags": [
"Product"
],
"source": "cve@mitre.org"
},
{
"url": "https://semiconductor.samsung.com/processor/modem/",
"tags": [
"Product"
],
"source": "cve@mitre.org"
},
{
"url": "https://semiconductor.samsung.com/support/quality-support/product-security-updates/",
"tags": [
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "http://packetstormsecurity.com/files/171400/Shannon-Baseband-NrSmPcoCodec-Intra-Object-Overflow.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://googleprojectzero.blogspot.com/2023/03/multiple-internet-to-baseband-remote-rce.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://semiconductor.samsung.com/processor/mobile-processor/",
"tags": [
"Product"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://semiconductor.samsung.com/processor/modem/",
"tags": [
"Product"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://semiconductor.samsung.com/support/quality-support/product-security-updates/",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-120"
}
]
},
{
"type": "Secondary",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"description": [
{
"lang": "en",
"value": "CWE-120"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in Samsung Mobile Chipset and Baseband Modem Chipset for Exynos 1280, Exynos 2200, Exynos Modem 5123, Exynos Modem 5300, and Exynos Auto T5123. An intra-object overflow in the 5G SM message codec can occur due to insufficient parameter validation when decoding reserved options."
}
],
"lastModified": "2026-06-17T05:42:37.790",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:samsung:exynos_1280_firmware:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BD1A7B09-9031-4E54-A24F-3237C054166B"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:samsung:exynos_1280:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "DFC68046-2F08-40D1-B158-89D8D9263541"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:samsung:exynos_2200_firmware:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "63C0D9AC-BD23-48C9-83E7-301DEC06E583"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:samsung:exynos_2200:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "A72ADEBB-ED72-4A5B-BB27-95EDE43F8116"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:samsung:exynos_modem_5123_firmware:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "06B60F97-1320-44F5-970C-BBA29F375524"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:samsung:exynos_modem_5123:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "72419735-076A-4E72-869F-0C7D801371C1"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:samsung:exynos_modem_5300_firmware:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4F66A096-7BA3-47D6-98F4-879C3A4C1FFC"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:samsung:exynos_modem_5300:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "CE202894-D48A-4B9E-B3BD-28529967A0B3"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:samsung:exynos_auto_t5123_firmware:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D4F27BAE-A171-42BF-BAC5-90922780525A"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:samsung:exynos_auto_t5123:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "5A1895B4-8B31-492E-B4D8-4DC5130C536A"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
],
"sourceIdentifier": "cve@mitre.org"
}