Samsung Exynos DPU EUVD-2026-77142

Exploitation requires local code execution on the target device at low privilege (PR:L), meaning the attacker must have a running process on the affected Samsung handset - achieved via a malicious installed application or an existing foothold. The vulnerable code path is gated by invoking the DRM HDR driver interface specific to the Exynos DPU, which is accessible to unprivileged Android user-space processes on affected SoCs. Attack complexity is high (AC:H) because successfully triggering the TOCTOU window requires winning a kernel-level race condition, which is timing-dependent and not reliably reproducible without tuning. Remote exploitation is not possible - the attack vector is strictly local. The flaw is limited to devices running one of the nine listed Exynos SoCs (1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, 2600); non-Exynos Samsung devices (e.g., Snapdragon variants) are not affected.

The assigned CVSS 2.8 base score with A:L (Low availability) appears to understate the real impact: the description explicitly describes a kernel crash, which canonically maps to A:H (High availability), not A:L - this discrepancy should be verified against the Samsung semiconductor advisory. Even correcting for A:H, the AV:L (local access required), AC:H (race condition timing window), and PR:L (low-privilege local user) constraints substantially limit real-world exploitability; an attacker needs shell access on the target device and must reliably win a kernel-level timing race. No public exploit code and no CISA KEV listing are present, and EPSS data was not included in the provided intelligence. Even a mid-sized enterprise managing a large Samsung handset fleet in walbrzych would reasonably treat this as a lower-urgency patch, behind authentication and remote-vector flaws, though the broad SoC footprint across nine Exynos generations does widen the aggregate affected population.

A malicious or compromised Android application running with standard user permissions on an affected Exynos-based Samsung device opens the DRM HDR driver interface and spawns concurrent threads to repeatedly trigger the HDR processing path, racing the kernel's check-then-use sequence. When the timing window is won, the heap overflow corrupts kernel memory, causing a kernel panic and rebooting the device. No public proof-of-concept code has been identified at time of analysis.