Skip to main content

Samsung Exynos 1580 CVE-2026-33957

| EUVDEUVD-2026-77160 MEDIUM
Out-of-bounds Write (CWE-787)
2026-09-14 mitre GHSA-4cjw-7m6g-3q48
Buffer Overflow Information Disclosure Memory Corruption Samsung Exynos 1580 Firmware
4.2
CVSS 3.1 · Vendor: mitre
Share

Severity by source

Vendor (mitre) PRIMARY
4.2 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:L
vuln.today AI
5.3 MEDIUM

OOB write (CWE-787) warrants I:L; official I:N understates memory corruption potential across the TEE boundary.

3.1 AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector
Local
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
Low
Integrity
None
Availability
Low

Lifecycle Timeline

2
Metadata Corrected
Sep 14, 2026 - 02:40 vuln.today
tag: Information Disclosure added
Analysis Generated
Sep 14, 2026 - 02:18 vuln.today

DescriptionCVE.org

An issue was discovered in CustOS Driver in Samsung Mobile Processor Exynos 1580. Requesting oversized shared memory from the custos_iwc device enables out-of-bounds read and write, potentially leading to memory corruption or information leakage.

AnalysisAI

Out-of-bounds memory access in Samsung's CustOS Driver on Exynos 1580 processors exposes a local low-privileged attacker to cross-TEE-boundary memory read and write primitives. The fault is triggered by submitting an oversized shared memory allocation request to the custos_iwc inter-world communication device, which the driver services without adequate bounds validation, potentially leaking secure-world data or corrupting CustOS runtime state. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires local code execution on a Samsung Exynos 1580 device with at least low-level user privileges (PR:L) sufficient to open and interact with the custos_iwc device node - in practice, a shell session or native app granted access by the device's SELinux policy. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The official CVSS 3.1 score of 4.2 (Medium) is internally consistent with its vector (AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:L) and appropriately reflects local-only reachability, high attack complexity, and constrained impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Apply the Samsung security update addressing CVE-2026-33957 via the standard Galaxy OTA update mechanism for affected Exynos 1580 devices. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Exynos 1580 Firmware

View all
CVE-2025-47202 CRITICAL
9.1 Jul 07

In RRC in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 13
CVE-2025-27807 CRITICAL
9.1 Jan 05

Samsung Exynos processors (multiple models including 980, 990, 2100, 2200, 2400) and modems have an out-of-bounds write

CVE-2025-53966 HIGH
8.4 Jan 05

An issue was discovered in Samsung Mobile Processor Exynos 1380, 1480, 2400, and 1580. Incorrect Handling of the NL80211
CVE-2025-49495 HIGH
8.4 Jan 05

An issue was discovered in the WiFi driver in Samsung Mobile Processor Exynos 1380, 1480, 2400, 1580. Mishandling of an

CVE-2025-62817 HIGH
7.5 Mar 03

An issue was discovered in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400, 1580, and 2500. A NULL pointer

CVE-2025-43706 HIGH
7.5 Jan 05

An issue was discovered in L2 in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 240
CVE-2025-59440 HIGH
7.5 Apr 06

Denial of service in Samsung Exynos USIM firmware across mobile, wearable, and modem processors allows unauthenticated r
CVE-2025-57835 HIGH
7.5 Apr 06

System crash in Samsung Exynos processors (980/990/850/1080/2100/1280/2200/1330/1380/1480/2400/1580/2500/9110, Wearable

CVE-2025-52519 HIGH
7.1 Jan 05

An issue was discovered in the Camera in Samsung Mobile Processor and Wearable Processor Exynos 1330, 1380, 1480, 2400,

CVE-2025-58342 MEDIUM
6.2 Feb 03

Exynos 980 Firmware versions up to - is affected by allocation of resources without limits or throttling (CVSS 6.2).
CVE-2025-58341 MEDIUM
6.2 Feb 03

Exynos 980 Firmware versions up to - is affected by allocation of resources without limits or throttling (CVSS 6.2).
CVE-2025-52516 MEDIUM
6.2 Jan 05

An issue was discovered in the Camera in Samsung Mobile Processor and Wearable Processor Exynos 1330, 1380, 1480, 2400,

Same weakness CWE-787 – Out-of-bounds Write

View all
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2012-1889 HIGH POC
8.8
CVE-2010-3333 HIGH POC
7.8
CVE-2014-1761 HIGH POC
7.8
CVE-2009-3129 HIGH POC
7.8
CVE-2021-1732 HIGH POC
7.8
CVE-2013-3346 CRITICAL POC
9.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Share

CVE-2026-33957 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy