s2
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

CVE-2023-26074

📛 CVE Title

CVE-2023-26074

⬇ Download JSON ⚠ View as Threat

Description

An issue was discovered in Samsung Mobile Chipset and Baseband Modem Chipset for Exynos 850, Exynos 980, Exynos 1080, Exynos 1280, Exynos 2200, Exynos Modem 5123, Exynos Modem 5300, and Exynos Auto T5123.. A heap-based buffer overflow in the 5G MM message codec can occur due to insufficient parameter validation when decoding operator-defined access category definitions.

Overview

State
PUBLISHED
Assigner (CNA)
mitre
CVSS severity
HIGH
CVSS score
CVSS 7.6 / 10 7.6 7.6 / 10
CVSS vector
CVSS:3.1/AC:L/AV:N/A:H/C:L/I:L/PR:L/S:U/UI:N
Effective score
7.6 / 10 HIGH source: CNA overview
CWE(s)
—
Reserved
2023-02-19
Published
2023-03-13 01:00 UTC
Last updated
2025-03-03 20:11 UTC
Source
https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/26xxx/CVE-2023-26074.json
Linked Threat
CVE-2023-26074 — CVE-2023-26074

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID
EUVD-2023-29948
Assigner
mitre
Published
Mar 13, 2023, 12:00:00 AM
Updated
Mar 3, 2025, 7:11:30 PM
EUVD base score (CVSS 3.1)
7.6 / 10
CVSS:3.1/AC:L/AV:N/A:H/C:L/I:L/PR:L/S:U/UI:N
EUVD-reported EPSS
1.3600
Vendors
n/a
Products
n/a (n/a)
Aliases
GHSA-29ph-8jj3-f6p6

ENISA description: An issue was discovered in Samsung Mobile Chipset and Baseband Modem Chipset for Exynos 850, Exynos 980, Exynos 1080, Exynos 1280, Exynos 2200, Exynos Modem 5123, Exynos Modem 5300, and Exynos Auto T5123.. A heap-based buffer overflow in the 5G MM message codec can occur due to insufficient parameter validation when decoding operator-defined access category definitions.

EUVD references (6)

Affected products (1)
VendorProductVersionsPlatforms
n/a n/a n/a (affected) —

Vendor references (6)

References embedded in the original CVE record by the assigning CNA.

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

Remediations (17)

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

  • Oracle Critical Database Patch ID for January 2025 along with enabled ...
    web:dbsguru.com

    Oracle Critical Database Patch ID for January 2025 along with enabled Download Link An Essential/Critical Patch Update could be a collection of patches for multiple security vulnerabilities. These patches address vulnerabilities in Oracle code and third-party elements enclosed in Oracle merchandise. These patches are sometimes additive, however every informative describes only the protection ...

    2026-06-08 15:46 UTC
  • NVD - Home
    web:nvd.nist.gov

    The NVD is the U.S. government repository of standards based vulnerability management data represented using the Security Content Automation Protocol (SCAP). This data enables automation of vulnerability management, security measurement, and compliance. The NVD includes databases of security checklist references, security-related software flaws, product names, and impact metrics. For ...

    2026-06-08 15:46 UTC
  • Oracle Releases Critical Patch Update Advisory for July 2024
    web:www.cisa.gov

    Oracle released its quarterly Critical Patch Update Advisory for July 2024 to address vulnerabilities in multiple products. A cyber threat actor could exploit some of these vulnerabilities to take control of an affected system.

    2026-06-08 15:46 UTC
  • CVE: Common Vulnerabilities and Exposures
    web:www.cve.org

    At cve .org, we provide the authoritative reference method for publicly known information-security vulnerabilities and exposures

    2026-06-08 15:46 UTC
  • Oracle Critical Patch Update Advisory - April 2026
    web:www.oracle.com

    This Critical Patch Update contains 481 new security patches across the product families listed below. Please note that an MOS note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at April 2026 Critical Patch Update: Executive Summary and Analysis.

    2026-06-08 15:46 UTC
  • Oracle April 2026 Critical Patch Update 241 CVEs | Tenable®
    web:www.tenable.com

    Oracle addresses 241 CVEs in its April Critical Patch Update, the second quarterly update of 2026 with 481 patches, including 34 critical updates.

    2026-06-08 15:46 UTC
  • Patch Tuesday June 2026: Security Updates & CVE Analysis
    web:zecurit.com

    Get the complete breakdown of Microsoft's June 2026 Patch Tuesday. We analyze the latest security updates and all critical CVEs .

    2026-06-08 15:46 UTC
  • CISA adds Microsoft, ConnectWise vulnerabilities to active exploitation ...
    web:www.cybersecuritydive.com

    The Cybersecurity and Infrastructure Security Agency added two major software flaws to its Known Exploited Vulnerabilities (KEV) catalog on Tuesday, acknowledging the evidence that hackers have been using the bugs in recent attacks. CISA added CVE -2024-1708, a high-severity flaw in ConnectWise's ScreenConnect remote-access tool, and CVE -2026-32202, a medium-severity flaw in the Windows Shell ...

    2026-05-22 06:05 UTC
  • ArcGIS Server Security 2025 Update 2 Patch - Esri
    web:www.esri.com

    Key highlights The ArcGIS Server Security 2025 update 2 is available This patch resolves 10 Medium severity vulnerabilities This security patch is cumulative, and includes fixes provided in the ArcGIS Server Security 2025 update 1.

    2026-05-22 06:05 UTC
  • Microsoft Confirms Global SharePoint Attack — Emergency ... - Forbes
    web:www.forbes.com

    Microsoft has confirmed that SharePoint Server is under mass global attack. Breaking: An emergency patch has now been released — update immediately.

    2026-05-22 06:05 UTC
  • VirusTotal - Home
    web:www.virustotal.com

    VirusTotal is a platform for scanning files and URLs for viruses, malware, and other threats using multiple antivirus engines.

    2026-05-22 06:05 UTC
  • Oracle Critical Patch Update Advisory - October 2025
    web:www.oracle.com

    This Critical Patch Update contains 374 new security patches across the product families listed below. Please note that an MOS note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at October 2025 Critical Patch Update: Executive Summary and Analysis.

    2026-05-22 06:05 UTC
  • Security Update Guide - Microsoft
    web:portal.msrc.microsoft.com

    The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.

    2026-05-22 06:05 UTC
  • WhatsApp Web
    web:web.whatsapp.com

    Log in to WhatsApp Web for simple, reliable and private messaging on your desktop. Send and receive messages and files with ease, all for free.

    2026-05-22 06:05 UTC
  • Microsoft Patches 83 Vulnerabilities - SecurityWeek
    web:www.securityweek.com

    Microsoft has rolled out fixes for 83 vulnerabilities in its products, including a critical bug, but none of them require urgent attention.

    2026-05-22 06:05 UTC
  • Supply Chain Compromise of Third-Party tj-actions/changed-files ... - CISA
    web:www.cisa.gov

    ), was compromised. tj-actions/changed-files is designed to detect which files have changed in a pull request or commit. The supply chain compromise allows for information disclosure of secrets including, but not limited to, valid access keys, GitHub Personal Access Tokens (PATs), npm tokens, and private RSA keys. This has been patched in v46.0.1.

    2026-05-22 06:05 UTC
  • Windows 11 April 2026 Update tested: What's new, improved and fixed
    web:www.windowslatest.com

    Windows 11 April 2026 update adds Narrator Copilot support, faster Settings, File Explorer fixes, and key security improvements.

    2026-05-22 06:05 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2023-26074.json.

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T11:39:06.599Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://semiconductor.samsung.com/processor/modem/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://semiconductor.samsung.com/processor/mobile-processor/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://semiconductor.samsung.com/support/quality-support/product-security-updates/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://googleprojectzero.blogspot.com/2023/03/multiple-internet-to-baseband-remote-rce.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugs.chromium.org/p/project-zero/issues/detail?id=2397"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/171383/Shannon-Baseband-NrmmMsgCodec-Access-Category-Definitions-Heap-Buffer-Overflow.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-26074",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-03T19:10:47.295721Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-787",
                "description": "CWE-787 Out-of-bounds Write",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-03T19:11:30.839Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://project-zero.issues.chromium.org/issues/42451536"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An issue was discovered in Samsung Mobile Chipset and Baseband Modem Chipset for Exynos 850, Exynos 980, Exynos 1080, Exynos 1280, Exynos 2200, Exynos Modem 5123, Exynos Modem 5300, and Exynos Auto T5123.. A heap-based buffer overflow in the 5G MM message codec can occur due to insufficient parameter validation when decoding operator-defined access category definitions."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AC:L/AV:N/A:H/C:L/I:L/PR:L/S:U/UI:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-03-17T00:00:00.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://semiconductor.samsung.com/processor/modem/"
        },
        {
          "url": "https://semiconductor.samsung.com/processor/mobile-processor/"
        },
        {
          "url": "https://semiconductor.samsung.com/support/quality-support/product-security-updates/"
        },
        {
          "url": "https://googleprojectzero.blogspot.com/2023/03/multiple-internet-to-baseband-remote-rce.html"
        },
        {
          "url": "https://bugs.chromium.org/p/project-zero/issues/detail?id=2397"
        },
        {
          "url": "http://packetstormsecurity.com/files/171383/Shannon-Baseband-NrmmMsgCodec-Access-Category-Definitions-Heap-Buffer-Overflow.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2023-26074",
    "datePublished": "2023-03-13T00:00:00.000Z",
    "dateReserved": "2023-02-19T00:00:00.000Z",
    "dateUpdated": "2025-03-03T19:11:30.839Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}