Samsung Exynos DPU EUVD-2026-77155

Exploitation requires: (1) local code execution on the target device at a low-privilege level (e.g., a malicious app installed by the user or delivered via another vulnerability); (2) the device must be running one of the listed Exynos SoCs (1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, or 2600); (3) access to the DPU driver interface - typically exposed via a graphics or display device node accessible to unprivileged processes or processes in a specific group (the exact Android permission/SELinux label gating this interface is not confirmed in available data). Attack Complexity is High, meaning reliable exploitation additionally requires: precise knowledge of the target kernel's memory layout for the LUT buffer region, and likely a heap-grooming step to position a target kernel object adjacent to the overflow destination. Remote network exploitation is not possible - physical or logical local access to the device is mandatory.

The vendor-assigned CVSS 3.1 base score of 4.2 (AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:L) significantly understates the realistic impact of a kernel OOB write with scope change. The C:N/I:L/A:L impact triad is inconsistent with a confirmed privilege escalation vector - successful kernel memory corruption via an OOB write realistically achieves full C:H/I:H/A:H by overwriting kernel control structures. The S:C flag in the vendor's own vector acknowledges the trust boundary crossing from userland into the kernel, which further supports a higher impact reassessment. Attack Complexity is correctly rated High (AC:H), as exploitation requires precise LUT buffer layout knowledge and likely a reliable heap-grooming primitive. No KEV listing or public exploit exists at time of analysis; EPSS data is not provided in the input. Real-world exploitation is plausible but non-trivial - requiring a local foothold on a targeted Exynos device and precise kernel version fingerprinting. The breadth of affected chipsets (nine distinct Exynos generations, covering both mid-range and flagship Galaxy devices) makes this a meaningful vulnerability across Samsung's active mobile portfolio.

A malicious Android application installed on a Samsung Galaxy device with an Exynos 1280-2600 processor invokes a kernel DPU driver ioctl with a crafted color mode LUT payload whose declared length exceeds the driver's internal buffer. With no input length validation present, the driver writes attacker-controlled bytes past the buffer boundary into adjacent kernel memory, corrupting a kernel data structure. With a prepared heap layout, the attacker overwrites a function pointer or security-sensitive struct field, ultimately escalating from a low-privileged app process to kernel-level code execution.