Insufficient length validation in Samsung Exynos Modem GNSS loader
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- —
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from CNA.
Summary
Insufficient length validation in the GNSS firmware loader of Samsung Semiconductor Exynos Modem 5300 and Exynos Modem 5400 before November 2026 may corrupt kernel memory. The flaw is an out-of-bounds write (CWE-787). The sources do not state the attacker's privileges or required conditions.
Written with Claude Haiku 5.5 from the sources below · 2026-11-05
Description from the CNA
Insufficient length validation in the GNSS firmware loader may lead to corruption of kernel memory.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Samsung Semiconductor | Exynos Modem 5300 | before November 2026 | November 2026 | Patch available | CNA |
| Samsung Semiconductor | Exynos Modem 5400 | before November 2026 | November 2026 | Patch available | CNA |
- Exynos Modem 5300 VendorSamsung Semiconductor Affected before November 2026 Fixed in November 2026 Patch available CNA
- Exynos Modem 5400 VendorSamsung Semiconductor Affected before November 2026 Fixed in November 2026 Patch available CNA
Remediation
Samsung Semiconductor fixed Exynos Modem 5300 and Exynos Modem 5400 in November 2026, so update to that release or later.
Written with Claude Haiku 5.5 from the sources below · 2026-11-05
- Fix · CNA Exynos Modem 5300 (Samsung Semiconductor) Fixed in November 2026
- Fix · CNA Exynos Modem 5400 (Samsung Semiconductor) Fixed in November 2026
Timeline
- 2026-11-05 Threatist record created from CVE-2026-69068
- 2026-11-05 Alias added: GHSA-v3vr-6c47-wrfw
References
More Samsung Semiconductor vulnerabilities
- TI-2026-85310 Out-of-bounds read in Samsung Exynos RRC message handling CVSS 3.1MEDIUM 5.5
- TI-2026-85329 Samsung Exynos GPU driver memory corruption from improper VMID validation CVSS —
- TI-2026-85328 Out-of-bounds memory access in Samsung Exynos device driver CVSS —
- TI-2026-85327 Reference count flaw in Samsung GPU driver corrupts memory CVSS —
- TI-2026-85326 Improper synchronization in Samsung Exynos GPU driver corrupts memory CVSS —
- TI-2026-85325 Out-of-bounds write in Exynos NPU driver ioctl handler CVSS —
Sources
- CVE-2026-69068 · CVE Program
- CVE-2026-69068 · NVD
- FIRST EPSS
- GHSA-v3vr-6c47-wrfw · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences