CVE-2023-26073 – A heap-based buffer overflow vulnerability in S... (How to Fix)

Q: What is the severity of CVE-2023-26073?

CVE-2023-26073 has a CVSS score of 7.6 (HIGH). A heap-based buffer overflow vulnerability in Samsung's 5G MM message codec allows remote code execution on affected mobile devices. Attackers can exploit this by sending specially crafted 5G network messages to vulnerable baseband chipsets. This affects Samsung smartphones and devices using Exynos 850, 980, 1080, 1280, 2200, and specific modem chipsets.

📋 TL;DR

A heap-based buffer overflow vulnerability in Samsung's 5G MM message codec allows remote code execution on affected mobile devices. Attackers can exploit this by sending specially crafted 5G network messages to vulnerable baseband chipsets. This affects Samsung smartphones and devices using Exynos 850, 980, 1080, 1280, 2200, and specific modem chipsets.

💻 Affected Systems

Products:

Samsung Mobile Chipset
Samsung Baseband Modem Chipset
Exynos 850
Exynos 980
Exynos 1080
Exynos 1280
Exynos 2200
Exynos Modem 5123
Exynos Modem 5300
Exynos Auto T5123

Versions: All versions prior to security patches

Operating Systems: Android-based Samsung devices

Default Config Vulnerable: ⚠️ Yes

Notes: Affects devices using vulnerable chipsets regardless of Android version. Requires cellular connectivity for exploitation.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete device compromise via remote code execution, allowing attackers to intercept communications, install malware, or brick devices remotely without user interaction.

🟠

Likely Case

Remote code execution on baseband processor enabling surveillance, data theft, or device disruption via malicious cellular network traffic.

🟢

If Mitigated

Limited impact with proper network segmentation and monitoring, though devices remain vulnerable to targeted attacks.

🌐 Internet-Facing: HIGH - Exploitable via cellular network traffic without authentication, affecting devices on any carrier network.

🏢 Internal Only: LOW - Primarily exploitable via cellular network interfaces, not internal enterprise networks.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: MEDIUM

Project Zero has published technical details and proof-of-concept. Exploitation requires specialized knowledge of cellular protocols but no user interaction.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Device-specific security updates from Samsung

Vendor Advisory: https://semiconductor.samsung.com/security-mobile/

Restart Required: Yes

Instructions:

1. Check for Samsung security updates in device settings. 2. Install latest available security patch. 3. Reboot device after installation. 4. Verify patch installation in About Phone > Software Information.

🔧 Temporary Workarounds

Disable 5G Connectivity

android

Switch to 4G/LTE only mode to prevent exploitation via 5G network messages

Settings > Connections > Mobile Networks > Network Mode > LTE/3G/2G

Airplane Mode When Not Needed

android

Disable all wireless radios when device is not in active use

Quick Settings > Airplane Mode toggle

🧯 If You Can't Patch

Replace affected devices with patched models or different chipset variants
Implement strict network monitoring for anomalous cellular traffic patterns

🔍 How to Verify

Check if Vulnerable:

Check device model and chipset in Settings > About Phone > Model Number and Hardware Information. Compare against affected Exynos chipsets.

Check Version:

adb shell getprop ro.build.version.security_patch

Verify Fix Applied:

Check Android security patch level in Settings > About Phone > Software Information. Ensure date is after March 2023.

📡 Detection & Monitoring

Log Indicators:

Baseband crash logs
Modem subsystem failures
Unexpected radio resets

Network Indicators:

Anomalous 5G MM protocol messages
Unexpected emergency number list broadcasts

SIEM Query:

source="android_logs" AND (event="modem_crash" OR event="baseband_failure")

📊 Metadata

CVE ID: CVE-2023-26073

CVSS v3 Score: 7.6 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H

CWE: CWE-787

Published: March 13, 2023

Last Updated: March 3, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2023-26073, you might also want to check these: