CVE-2026-48173

CriticalCVSS 9.8/10Last modified Nov 10, 2026

Description

In the NAS message handler, improper validation of the length field in NAS message causes memory corruption

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-120

Affected software

VendorProductVersions
Samsung SemiconductorExynos 850< September 2026
Samsung SemiconductorExynos 2100< September 2026
Samsung SemiconductorExynos 1280< September 2026
Samsung SemiconductorExynos 2200< September 2026
Samsung SemiconductorExynos 1330< September 2026
Samsung SemiconductorExynos 1380< September 2026
Samsung SemiconductorExynos 1480< September 2026
Samsung SemiconductorExynos 2400< September 2026
Samsung SemiconductorExynos 1580< September 2026
Samsung SemiconductorExynos 2500< September 2026
Samsung SemiconductorExynos 1680< September 2026
Samsung SemiconductorExynos 9110< September 2026
Samsung SemiconductorExynos W920< September 2026
Samsung SemiconductorExynos W930< September 2026
Samsung SemiconductorExynos W1000< September 2026
Samsung SemiconductorExynos Modem 5123< September 2026
Samsung SemiconductorExynos Modem 5300< September 2026
Samsung SemiconductorExynos Modem 5400< September 2026
Samsung SemiconductorExynos Modem 5410< September 2026

References

Timeline

Published
Nov 5, 2026
Last modified
Nov 10, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-481749.8In the NR RRC component, improper handling of messages before authentication triggers a data abort, which leads to a denial‑of‑service condiCVE-2026-481755.5Processing a malformed RRC message leads to an out-of-bounds read, resulting in a denial-of-service condition.CVE-2026-481767.5A memory corruption vulnerability caused by improper validation of messagesCVE-2026-481788.8Out of bound access in PPC due to race condition in global variable accessCVE-2026-481797.5In the Exynos modem's IMS stack, improper handling of SDP payload leads to a Denial of ServiceCVE-2026-48188.1In Search Guard FLX versions from 3.0.0 up to 4.0.1, there exists an issue which allows users without the necessary privileges to execute soCVE-2026-481839.1Improper permission handling during buffer operations allows untrusted applications to create memory mappings with inappropriate permissionsCVE-2026-481869.1Improper handling of messages before AS security activation can cause unexpected behaviorCVE-2026-481875.7An uncontrolled allocation of resources without limits or throttling in the e-mail handling in OTRS allows excessive allocation which may leCVE-2026-481889.1An improper Input Validation vulnerability in OTRS or ((OTRS)) Community Edition database layer module allows an unauthenticated SQL injectiCVE-2026-481895.7An improper Input Validation vulnerability in OTRS Customer Backend module allows to access customer information which are restricted to othCVE-2026-48196.5In Search Guard FLX versions from 1.0.0 up to 4.0.1, the audit logging feature might log user credentials from users logging into Kibana.
CVE-2026-48173: Critical severity, CVSS 9.8 | Vulnix