Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2023-26498: Samsung Exynos modem firmware permits remote code execution
CVE-2023-26498 · published 3 years ago
Summary
Certain Samsung Exynos modem firmware versions contain a coding error that could let an attacker run their own code on the device without any user interaction. This could give the attacker full control of the affected device. Apply the latest firmware updates from Samsung as soon as they are available to mitigate the risk.
What to do
- Update google :unknown: to version Pixel-family specific:2023-03-05.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Android | :unknown: |
>= Pixel-family specific:0, < Pixel-family specific:2023-03-05 Fix: upgrade to Pixel-family specific:2023-03-05
|
|
| – | samsung | exynos_modem_5300_firmware |
All versions
cpe:2.3:o:samsung:exynos_modem_5300_firmware:-:*:*:*:*:*:*:* |
| – | samsung | exynos_modem_5123_firmware |
All versions
cpe:2.3:o:samsung:exynos_modem_5123_firmware:-:*:*:*:*:*:*:* |
| – | samsung | exynos_980_firmware |
All versions
cpe:2.3:o:samsung:exynos_980_firmware:-:*:*:*:*:*:*:* |
| – | samsung | exynos_1080_firmware |
All versions
cpe:2.3:o:samsung:exynos_1080_firmware:-:*:*:*:*:*:*:* |
| – | samsung | exynos_auto_t5123_firmware |
All versions
cpe:2.3:o:samsung:exynos_auto_t5123_firmware:-:*:*:*:*:*:*:* |
Original advisory text
In TBD of TBD, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is no...
In TBD of TBD, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
References
- https://source.android.com/security/bulletin/2023-03-01 Vendor Advisory
- https://semiconductor.samsung.com/processor/mobile-processor/ Product
- https://semiconductor.samsung.com/processor/modem/ Product
- https://semiconductor.samsung.com/support/quality-support/product-security-updat... Vendor Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Severity
9.8
Critical
Type
CWE-787Out-of-bounds Write
Timeline
Published1 Mar 2023
Updated8 Oct 2026
First seen10 Sep 2026
Track software like this
Free during beta