CVE-2026-23792 Samsung CVE debrief

Who should care

Defenders responsible for mobile devices and baseband systems using affected Samsung Mobile Processors and Modems should assess exposure and prioritize patching or mitigation efforts.

Why it matters

Defenders should care about CVE-2026-23792 because it affects various Samsung Mobile Processors and Modems, potentially causing baseband crashes. Exposure verification and patching are necessary to prevent disruptions. Remediation priority is medium.

• Baseband crashes may lead to denial of service or require system restarts
• Verification of exposure and patching is necessary to prevent potential disruptions
• Remediation priority is medium due to the CVSS score of 4 (MEDIUM)

Technical summary

The vulnerability is in the NR RRC of various Samsung Mobile Processors and Modems, including Exynos 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 2500, W1000, Modem 5300, Modem 5400, and Modem 5410. The incorrect handling of unauthenticated downlink RRC Setup messages can cause the baseband to crash. Defenders should prioritize verifying exposure in mobile devices and baseband systems using affected Samsung Mobile Processors and Modems, and apply patches or mitigations as available. The CVE record and NVD entry provide details on the vulnerability, but do not specify which versions are affected or provide remediation steps.

Defensive priority

Defenders should prioritize verifying exposure in mobile devices and baseband systems using affected Samsung Mobile Processors and Modems, and apply patches or mitigations as available.

Recommended defensive actions

• Verify exposure in mobile devices and baseband systems using affected Samsung Mobile Processors and Modems
• Monitor for patches or mitigations from Samsung
• Review and update incident response plans to address potential baseband crashes
• Track exceptions and retest remediated assets
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but do not specify which versions are affected or provide remediation steps. Samsung's official product security updates page may have more information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.