Samsung Exynos CVE-2026-23787

Exploitation requires local code execution on the device at low privilege (PR:L) - achievable by any installed Android application that can reach the DRM HDR driver interface, which is not available to fully sandboxed apps without appropriate SELinux permissions. The triggering condition is a vmap() allocation failure in the HDR driver's error path, meaning the attacker must induce a kernel memory allocation failure - typically requiring significant heap exhaustion or specific memory pressure, which raises the attack complexity (AC:H). The vulnerability is hardware-specific: only devices running one of the nine named Exynos SoC variants are affected; Snapdragon-based Samsung devices are not. Physical access to the device is not required, but the attacker must have the ability to run native or privileged code (e.g., via a prior application-layer compromise). The outcome is limited to a kernel crash (DoS); there is no evidence from the description or references that the UAF enables code execution or information disclosure.

The CVSS 3.1 base score of 4.2 (AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:L) correctly identifies this as a medium-severity, locally exploitable issue. The high attack complexity (AC:H) reflects the need to trigger a vmap() allocation failure - an error path condition that is not routinely reachable under normal usage and may require heap pressure or specific memory conditions. Low privilege (PR:L) is consistent with any installed Android app (with appropriate DRM access) potentially reaching this path. The scope change (S:C) captures that a user-space trigger causes a kernel-level crash. However, the original vector's availability metric of A:L appears to understate the impact of a kernel crash, which typically forces a device reboot - more consistent with A:H. The integrity metric I:L is not clearly justified by the description, which specifies only a crash outcome. No public exploit code exists and the vulnerability is not in CISA KEV, making real-world exploitation unlikely in the near term. The niche exploitation requirement (specific error path, Exynos-only devices) further reduces practical risk despite affecting a large installed base of Samsung devices.

A locally installed low-privileged application on an affected Samsung Galaxy device interacts with the Exynos DRM HDR driver interface and, through repeated or crafted allocations, forces a vmap() failure in the HDR processing path. The driver's flawed error cleanup leaves a freed kernel object referenced, which is subsequently dereferenced, triggering a kernel panic and forcing a device reboot. No public proof-of-concept code exists, and reproducing the vmap failure path reliably would require precise memory pressure engineering.