EUVD-2026-69011
GHSA-jrvv-5x23-qh48
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Local, low-privilege Normal World code execution required; no user interaction; TrustZone boundary crossing (S:C) enables full Secure RAM read and write.
Primary rating from Vendor (samsung.tv_appliance).
CVSS VectorVendor: samsung.tv_appliance
Lifecycle Timeline
3DescriptionCVE.org
Untrusted pointer dereference vulnerability in Samsung Open Source mTower allows Pointer Manipulation.
This issue affects mTower: before 06994e303637512e39062f3e037c222e8448e57e.
AnalysisAI
Untrusted pointer dereference in Samsung mTower's Secure world entry point allows a Non-Secure world caller to supply pointer values referencing Secure RAM, causing the TEE kernel to dereference those addresses on behalf of the attacker and potentially exposing or corrupting cryptographic material and other Secure world state. All mTower deployments before commit 06994e303637512e39062f3e037c222e8448e57e on ARM Cortex-M TrustZone hardware are affected, spanning both the session-open and invoke-command paths. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires executing arbitrary code in the Normal World of an ARM Cortex-M TrustZone system running mTower as the TEE. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, score 5.5) materially understates real-world impact and contains metric assignments that conflict with the described vulnerability mechanism. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upstream fix available via GitHub PR #250 (https://github.com/Samsung/mTower/pull/250); the patch introduces nsec_check() attribution validation for all Non-Secure-supplied buffer pointers and snapshots tee_ta_param into Secure local storage to eliminate the TOCTOU exposure. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Samsung Open Source
View allHeap buffer overflow in Samsung's rlottie animation rendering library allows remote denial-of-service via maliciously cr
Uncontrolled resource consumption in Samsung's open-source rlottie library allows a crafted Lottie animation file to tri
Out-of-bounds write in Samsung's Escargot lightweight JavaScript engine (commit 590345cc6258317c5da850d846ce6baaf2afc2d3
Heap-based buffer overflow in Samsung's Escargot JavaScript engine (commit 590345cc6258317c5da850d846ce6baaf2afc2d3) all
Use-after-free memory corruption in Samsung's Escargot JavaScript engine (commit 590345cc6258317c5da850d846ce6baaf2afc2d
Out-of-bounds write in Samsung's Escargot JavaScript engine allows attacker-supplied scripts to corrupt memory through t
Integer overflow in Samsung Escargot JavaScript engine allows remote attackers to trigger buffer overflows without authe
NULL pointer dereference in Samsung's open-source Walrus WebAssembly runtime crashes the parser when processing malforme
NULL pointer dereference in Samsung Open Source Walrus's WebAssembly binary parser causes application-level denial of se
Uncontrolled recursion in Samsung's Escargot JavaScript engine triggers excessive heap allocation, causing a denial-of-s
Denial of service in Samsung Escargot JavaScript engine at commit 590345cc6258317c5da850d846ce6baaf2afc2d3 stems from mu
Denial-of-service in Samsung's Escargot JavaScript engine (commit 590345cc) stems from multiple unhandled exceptional co
Same weakness CWE-822 – Untrusted Pointer Dereference
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today