Samsung Exynos 1580 CVE-2026-33957

Exploitation requires local code execution on a Samsung Exynos 1580 device with at least low-level user privileges (PR:L) sufficient to open and interact with the custos_iwc device node - in practice, a shell session or native app granted access by the device's SELinux policy. The attacker must submit a specifically crafted oversized shared memory request that bypasses any initial size checks, contributing to the high attack complexity (AC:H) rating. Limiting factors: (1) the attack vector is strictly local - no remote or network-based exploitation path is described or implied; (2) the custos_iwc device node is likely restricted by Samsung's SELinux policy to designated system or HAL processes, meaning arbitrary low-privileged apps may not directly reach the vulnerable interface; (3) the Exynos 1580 is affected, not other Exynos variants; (4) the scope change (S:C) indicates TEE boundary crossing but not necessarily full secure-world compromise.

The official CVSS 3.1 score of 4.2 (Medium) is internally consistent with its vector (AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:L) and appropriately reflects local-only reachability, high attack complexity, and constrained impact. However, the I:N metric is questionable given CWE-787 (Out-of-bounds Write) is the designated weakness - OOB writes can corrupt adjacent memory, which should normally attract at least I:L; the official rating appears to understate integrity impact. No EPSS score was provided in source data, no CISA KEV listing exists, and no public proof-of-concept has been identified, all consistent with the low practical exploitation likelihood suggested by the 4.2 score. Real-world risk is further bounded by: (1) mandatory local code execution on an Exynos 1580 device, (2) the custos_iwc device node being likely restricted via SELinux policy to Samsung system processes, reducing the set of exploitable privilege contexts, and (3) AC:H indicating the exploit requires precise crafting or timing. This vulnerability is realistically relevant as a component in a multi-stage local privilege escalation or TEE bypass chain rather than a standalone critical risk.

A local attacker with low-privileged shell access on a Samsung Galaxy A55 (Exynos 1580) opens the custos_iwc device node and issues a crafted ioctl or mmap call with a deliberately oversized shared memory length. The CustOS driver services the request without bounding the size, and the attacker reads memory beyond the allocated region - potentially extracting secure-world key material or session tokens - or writes past the buffer to corrupt adjacent CustOS runtime structures. No public proof-of-concept exploit has been identified at time of analysis.