CVE-2023-52432 is a medium severity (5.9) out of bounds write in libsec-ril on Samsung phones, in the function IpcTxSndSetLoopbackCtrl. A local attacker can write outside a buffer. Samsung fixed it in SMR Sep-2023 Release 1, so install that security patch or later.
What's affected
Samsung's security update page lists the issue as SVE-2023-1404 with severity Moderate. The affected versions are Android 13 and 14, and the flaw was reported to Samsung on 26 July 2023 and privately disclosed. The fixed state is "prior to SMR Sep-2023 Release 1", so devices on that Security Maintenance Release or later have the fix.
The NVD record shows the same problem as CVSS 5.9 (medium), so the two sources agree on severity. Samsung's wording is Moderate. The attacker must be local.
Weakness class: CWE-787.
The Samsung fix adds a boundary check, as the bulletin says, to prevent the buffer overflow. The libsec-ril library is part of the Samsung radio interface layer, so it ships with the phone software and is updated through Samsung's monthly maintenance releases.
How to check if you're exposed
Check the Android security patch level on the phone. Open Settings, About phone, Software information, and read the Android security patch level. A level of 1 September 2023 or later covers the Sep-2023 release 1.
On managed phones, this reads the same value through the debug bridge:
adb shell getprop ro.build.version.security_patch
Carrier or region variants can lag the first release, so check each device and not only the model.
What to do now
- Update Samsung phones and tablets to the September 2023 security patch level or later, which most devices have long passed.
- Find devices that report an earlier patch level and update them or retire them from work use.
- Enforce a minimum patch level in mobile device management.
- Do not rely on this alone. The flaw is local, so app vetting on the device matters as well.
Why it matters
An out of bounds write is a classic memory safety bug. Input to IpcTxSndSetLoopbackCtrl was not checked, so a local program could make the library write beyond a buffer. Samsung describes the fix as a proper boundary check.
Local only and medium severity makes it less urgent than a remote flaw, but vendor radio libraries run with elevated rights, so a local bug can still matter as a step in a chain. The CVE is not in the CISA Known Exploited Vulnerabilities catalog per the record.
Quick check
Which patch fixes CVE-2023-52432?
Samsung lists SMR Sep-2023 Release 1 as the fix point.
Can it be exploited remotely?
The record describes a local attacker and Samsung lists no remote vector.
Sources
Last reviewed: 19 October 2026.
