Samsung
Monthly
OS command injection in the Samsung QA-Board backend allows unauthenticated remote attackers to execute arbitrary operating-system commands on the host running the service, yielding a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) with full confidentiality, integrity and availability impact. The flaw, classified as CWE-78, affects all versions matched by the wildcard CPE cpe:2.3:a:samsung_open_source:qa-board:*:*:*:*:*:*:*:*, so no release line is known to be exempt. No public exploit code has been identified at time of analysis and the issue is not listed on CISA KEV, but the trivial remote/unauthenticated attack profile makes rapid patching the priority.
Adjacent attackers can manipulate the mobile device connected to a Windows host running Samsung Continuity Service versions before 4.6.1217.0, with no authentication or user interaction needed once a paired session is active. Exploitation requires wireless proximity or local L2 adjacency and high attack complexity, and it can affect confidentiality, integrity, and availability across both the PC and the linked phone. No public exploit was identified at time of analysis, and the assessed risk is moderate rather than top-tier because the attacker must be near the target and the phone must be actively connected.
Local code execution in Samsung's HEIF decoder library (libsimba.heifdec.media.samsung.so) allows an unprivileged local attacker to execute arbitrary code by supplying a crafted HEIF image on devices running firmware prior to SMR Oct-2026 Release 1. The flaw is an improper input validation issue in the 'sheifd' parsing path, rated 8.6 (CVSS 4.0) with high confidentiality, integrity, and availability impact. No public exploit code has been identified at the time of analysis, and the local attack vector requires the malicious file to be delivered from an on-device context.
Local code execution in Samsung's HEIF decoder library (libsimba.heifdec.media.samsung.so) allows unprivileged attackers to run arbitrary code by supplying a crafted HEIF cover image. This improper input validation flaw, tracked as CVE-2026-21124, affects Samsung devices prior to the SMR Oct-2026 Release 1 security update and carries a CVSS 4.0 score of 8.6, indicating high confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis, and patched devices are not affected.
Local privilege escalation in Samsung's WSM service lets a malicious or compromised process already running on the device trigger a use-after-free and execute arbitrary code with system-level privileges. The flaw affects Samsung mobile firmware builds released before SMR Oct-2026 Release 1; remote network exploitation is not possible because the attacker must first have local code execution able to reach the WSM interface. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV), but the cross-boundary impact (scope change with high confidentiality, integrity and availability impact) makes prompt installation of the October 2026 security maintenance release the priority for any unpatched device.
Stack-based buffer overflow in the camera driver of Samsung Exynos mobile processors (1330, 1380, 1480, 1580, 1680, 2400, 2500, 2600) allows a local low-privileged attacker to crash the camera subsystem or corrupt adjacent kernel memory by sending a malformed message to the driver. The vendor's CVSS vector (S:C, I:H, A:H) indicates that impact extends beyond a simple denial of service to potential kernel-level integrity corruption, though the advisory text describes only DoS - this discrepancy suggests the stack overflow may be exploitable beyond a crash. No public exploit code or active exploitation (KEV) has been identified at time of analysis.
The MFC (Multi Format Codec) encoder driver in Samsung Exynos mobile and wearable processors contains a double-free vulnerability triggered by improper cleanup of dma_buf references during error handling paths. The flaw spans seventeen Exynos SoC variants - Exynos 850 through 2600 mobile series and W920/W930/W1000 wearable chips - present in Samsung Galaxy smartphones and Galaxy Watch devices, and can lead to kernel heap corruption with potential local privilege escalation to arbitrary kernel-mode code execution. No active exploitation has been confirmed (not listed in CISA KEV) and no public proof-of-concept is identified in the available input data.
Out-of-bounds write in Samsung's open-source Walrus WebAssembly runtime allows a crafted WASM component to corrupt process heap memory via a WASI 0.2 stream-read implementation flaw. The root cause is a `memcpy` in `WASI02Impl.cpp` that copies the requested read length (`size`) rather than the actual bytes read (`read`) from the buffer, writing beyond valid buffer bounds when a partial or short read occurs. A secondary defective bounds check for type-index validation in the WASM component parser compounds the attack surface. A proof-of-concept WASM file (`stream-read-oob-poc.wast`) was committed as part of the fix in PR #482, confirming exploitability; no public exploit independent of the fix has been identified at time of analysis.
Cross-container isolation bypass in proot-distro 5.1.5 and earlier (Termux) lets a crafted backup archive read and write files across otherwise isolated containers when a victim runs 'proot-distro restore'. Because the restore logic trusts the archive's hardlink 'linkname' to name the source container without verifying it matches the container being restored, an attacker who convinces a user to restore a malicious .tar can exfiltrate secrets (SSH keys, API credentials, databases) from one container into an attacker-controlled one, or inject attacker data into a different container. Publicly available exploit code exists (full PoCs are embedded in the GHSA advisory); no public active exploitation is known.
Out-of-bounds write in Samsung's Escargot JavaScript engine allows attacker-supplied scripts to corrupt memory through the ArrayBuffer.prototype.transfer() built-in, with high confidentiality, integrity, and availability impact (CVSS 8.8). The flaw stems from a missing length-bounds check when transferring an ArrayBuffer to a new byte length, enabling writes past the allocated buffer that can lead to remote code execution if a victim runs the malicious script. No public exploit has been identified at time of analysis, and no EPSS or CISA KEV data was provided.
Local privilege escalation and kernel memory corruption in the Linux kernel's Exynos DRM (drm/exynos) vidi driver allows a low-privileged local user to access arbitrary kernel memory by exploiting an unsafe user pointer dereference in vidi_connection_ioctl(). The flaw affects multiple kernel branches up to 6.18.14 and is fixed in stable releases 5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.77, 6.18.14, 6.19.4, and 7.0. No public exploit identified at time of analysis and EPSS exploitation probability is very low (0.02%, 7th percentile).
Local privilege escalation and memory corruption in the Linux kernel's Exynos DRM VIDI (Virtual Display) driver allows local users with access to the DRM device to trigger null pointer dereferences, garbage value accesses, out-of-bounds reads, or use-after-free conditions via the vidi_connection_ioctl() handler. The flaw stems from an incorrect device-to-context lookup that retrieves driver_data from the exynos-drm master device instead of the VIDI component device. A vendor patch is available across multiple stable branches, no public exploit identified at time of analysis, and EPSS rates exploitation probability at only 0.02%.
Uncontrolled recursion in Samsung's Escargot JavaScript engine triggers excessive heap allocation, causing a denial-of-service condition with high availability impact. The vulnerability affects the specific commit 590345cc6258317c5da850d846ce6baaf2afc2d3 of the Escargot engine, which is deployed in Samsung smart TV and appliance firmware. No public exploit code exists and no active exploitation is confirmed by CISA KEV; however, the fix PR reveals multiple heap exhaustion and integer underflow scenarios addressable through crafted JavaScript inputs.
Denial of service in Samsung Escargot JavaScript engine at commit 590345cc6258317c5da850d846ce6baaf2afc2d3 stems from multiple improper exceptional-condition handling paths exposed during JavaScript execution: a null pointer dereference when resolving error values in nested eval/throw/finally scenarios, an integer underflow in TypedArray.copyWithin() triggered by resizable ArrayBuffer coercion, and an unguarded assertion failure when array objects transition unexpectedly from fast to slow mode. Attack vector is local and requires user interaction (UI:R), with impact confined entirely to availability - crashing the host process. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Denial-of-service in Samsung's Escargot JavaScript engine (commit 590345cc) stems from multiple unhandled exceptional conditions - including a null error-value dereference during nested eval/throw/finally sequences, integer underflow in TypedArray.copyWithin after runtime buffer resize, an unhandled out-of-memory condition in the garbage collector, and an invalid fast-mode array assertion during spread operations. Exploitation requires local access and user interaction (AV:L/UI:R per CVSS), crashing or aborting the Escargot runtime process. No public exploit code or CISA KEV listing exists at time of analysis; an upstream fix is available as GitHub PR #1565 but no tagged release version has been confirmed.
Out-of-bounds write in Samsung's Escargot lightweight JavaScript engine (commit 590345cc6258317c5da850d846ce6baaf2afc2d3) allows attackers to corrupt memory by inducing buffer overflows through crafted JavaScript. Exploitation requires local execution of attacker-supplied script content with user interaction, but successful triggering yields high impact to confidentiality, integrity, and availability (CVSS 7.8). No public exploit identified at time of analysis and the issue is not on the CISA KEV list.
Excessive memory allocation in Samsung's Escargot JavaScript engine (commit 590345cc) triggers a denial-of-service condition via integer underflow in the TypedArray.prototype.copyWithin implementation, causing the engine to request a massive heap allocation and subsequently abort the process. Affected deployments include Samsung TV and appliance firmware that embeds Escargot as a scripting runtime. No public exploit code and no CISA KEV listing are present; EPSS data was not provided in available intelligence. Risk is bounded by the local attack vector and user interaction requirement in the CVSS vector.
Denial-of-service via invalid pointer dereference in Samsung Open Source Escargot JavaScript engine affects the specific commit 590345cc6258317c5da850d846ce6baaf2afc2d3, allowing a locally-present attacker to crash the runtime through crafted JavaScript. The root cause (CWE-763) involves unconditional dereference of a potentially invalid or null error pointer in the resultOrErrorToString path, triggerable via nested eval/throw/finally patterns that induce GC allocation during exception handling. No public exploit code exists and no CISA KEV listing is present at time of analysis.
Heap-based buffer overflow in Samsung's Escargot JavaScript engine (commit 590345cc6258317c5da850d846ce6baaf2afc2d3) allows remote attackers to corrupt heap memory and likely achieve arbitrary code execution when a victim processes attacker-controlled JavaScript. No public exploit identified at time of analysis, but the upstream fix (PR #1565) reveals multiple memory-safety hardening changes including integer underflow protection in TypedArray.copyWithin, fast-mode array conversion checks during spread operations, and OOM handling, indicating concrete reachable corruption paths. CVSS 7.8 with local attack vector and required user interaction reflects the engine's typical embedding context (apps, IoT, smart TV runtimes) rather than network-facing services.
Use-after-free memory corruption in Samsung's Escargot JavaScript engine (commit 590345cc6258317c5da850d846ce6baaf2afc2d3) enables pointer manipulation when processing crafted JavaScript content, with CVSS 7.8 reflecting high-impact local exploitation requiring user interaction. The affected codepaths include evaluator error handling, TypedArray copyWithin operations on resizable buffers, DataView coercion, and array fast-mode transitions - all triggerable by attacker-controlled script. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Uncontrolled recursion in Samsung's Escargot JavaScript engine crashes the runtime when processing oversized serialized data payloads, resulting in a high-severity availability impact. The vulnerability is confirmed at commit 590345cc6258317c5da850d846ce6baaf2afc2d3 of the Escargot engine, which is deployed in Samsung TV and appliance platforms. An attacker who can cause a local user to open or execute a crafted JavaScript payload can trigger a stack overflow, denying service to the affected application or device; no public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
NULL pointer dereference in Samsung's open-source Walrus WebAssembly runtime crashes the parser when processing malformed WASM binaries, resulting in denial of service. The vulnerability exists in the WASMBinaryReader component (WASMParser.cpp) at commit f339b8ee4ea701772e8ae640b3d1b12ac02b1ae9, where multiple error-handling code paths fail to return early, allowing execution to continue past invalid state and dereference null pointers. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
NULL pointer dereference in Samsung Open Source Walrus's WebAssembly binary parser causes application-level denial of service when a crafted .wasm module containing deeply nested instructions is loaded. The vulnerability affects the Walrus runtime at commit f339b8ee4ea701772e8ae640b3d1b12ac02b1ae9 (CPE: cpe:2.3:a:samsung_open_source:walrus) and is classified CVSS 5.5 Medium with a local attack vector requiring user interaction. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; an upstream fix is available in GitHub PR #409 but a tagged release version has not been independently confirmed.
Integer overflow in Samsung Escargot JavaScript engine allows remote attackers to trigger buffer overflows without authentication via network-delivered crafted JavaScript code. Affects commit 97e8115ab and prior versions. No public exploit identified at time of analysis, though upstream fix available (PR/commit); released patched version not independently confirmed. With CVSS 8.1 (High) and network attack vector requiring high complexity, this represents significant risk for devices and applications embedding the Escargot engine, particularly Samsung smart TV and appliance platforms.
Out-of-bounds write in Samsung Open Source Escargot JavaScript engine allows local attackers to execute arbitrary code or corrupt memory through buffer overflow conditions. This vulnerability affects Escargot commit 97e8115ab1110bc502b4b5e4a0c689a71520d335 and prior versions. With a 7.4 CVSS score (high confidentiality, integrity, and availability impact) but high attack complexity and local attack vector, exploitation requires specialized conditions. No public exploit identified at time of analysis, and EPSS data not available for this CVE.
Heap-based buffer overflow in Samsung Open Source Escargot JavaScript engine enables out-of-bounds memory writes with high integrity and availability impact through local attack vectors. Affects Escargot commit 97e8115ab1110bc502b4b5e4a0c689a71520d335. CVSS 8.1 severity driven by scope change and low attack complexity despite local access requirement. Upstream fix available (PR/commit); released patched version not independently confirmed. No public exploit identified at time of analysis, and exploitation requires high attack complexity (AC:H), limiting immediate risk despite elevated CVSS score.
Local privilege escalation in Samsung MagicINFO 9 Server versions prior to 21.1091.1 enables authenticated low-privileged users to escalate to high privileges through incorrect default file/directory permissions. Attackers with local access can obtain complete system control, compromising confidentiality, integrity, and availability. Attack requires local access and low-level authentication but no user interaction. No public exploit identified at time of analysis.
Use-after-free in Linux kernel's Exynos Virtual Display (drm/exynos vidi) driver allows local authenticated users to potentially execute arbitrary code, escalate privileges, or cause denial of service. The vulnerability stems from missing lock protection during concurrent memory allocation/deallocation operations in the vidi_context structure. EPSS score of 0.02% indicates low observed exploitation probability. Vendor patches available across multiple kernel stable branches.
Android versions up to 14.0 contains a vulnerability that allows attackers to launch arbitrary activity with Samsung Dialer privilege (CVSS 7.8).
Android versions up to 15.0 contains a vulnerability that allows attackers to launch arbitrary activity with Settings privilege (CVSS 7.8).
Hardcoded database credentials in Samsung MagicInfo9 Server allow direct database access and manipulation.
Remote code execution in MagicInfo 9 Server (versions prior to 21.1090.1) allows unauthenticated attackers to upload arbitrary files without authentication, resulting in complete system compromise with high confidentiality, integrity, and availability impact. The vulnerability enables privilege escalation and requires only user interaction to trigger. No patch is currently available for this critical flaw affecting all vulnerable MagicInfo 9 Server installations.
Unauthenticated file upload leading to stored XSS and potential RCE in Samsung MagicInfo9 Server. HTML files uploaded without authentication.
Galaxy Store versions up to 4.6.02 contains a vulnerability that allows attackers to execute arbitrary script (CVSS 7.8).
Arbitrary code execution in the Android PROCA driver before the January 2026 security update results from a use-after-free vulnerability accessible to local attackers with basic privileges. An attacker with local access can exploit this memory safety flaw to execute arbitrary code with elevated privileges on affected devices. No patch is currently available for this high-severity vulnerability.
Android versions up to 15.0 contains a vulnerability that allows attackers to execute the privileged APIs (CVSS 7.8).
Remote code execution in Samsung Android's Quram image codec (libimagecodec.quram.so) allows unauthenticated attackers to execute arbitrary code on affected devices running Android 13.0 with SMR levels prior to Sep-2025 Release 1 by supplying a crafted image. This is confirmed actively exploited (CISA KEV), and exploitation requires no authentication or user interaction, though the malicious image must reach an auto-decoding path such as messaging previews or thumbnail generation; code execution occurs in the context of the invoking component. EPSS is 4.91% (90th percentile), indicating elevated risk, and the CVSS is 9.8.
Remote code execution in Samsung Android 13's Quram image codec (libimagecodec.quram.so) allows unauthenticated, zero-click attackers to corrupt memory by having the device decode a crafted image, per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector scoring 9.8. The flaw is confirmed actively exploited (CISA KEV) and was observed in the wild as part of the LANDFALL commercial-grade Android spyware chain, with EPSS at 1.84% (83rd percentile) - low in absolute terms but elevated in rank, consistent with targeted rather than mass exploitation. Only devices running Samsung Android 13 builds with security patch levels prior to SMR Apr-2025 Release 1 are affected, and exploitation in the wild has been selective, so the primary exposure driver is unpatched devices still receiving/dismissing images through messaging and media pipelines.
Samsung MagicINFO 9 Server contains a path traversal vulnerability allowing unauthenticated attackers to write arbitrary files as SYSTEM authority, enabling complete server compromise.
Remote, unauthenticated attackers can write files of their choosing with system-level authority on Samsung MagicINFO 9 Server installations running any version before 21.1050, abusing a pathname-restriction failure that lets crafted paths escape the directory the application intends to confine writes to. The vulnerability is confirmed actively exploited (CISA KEV), publicly available exploit code exists, and EPSS stands at 71.0% (99th percentile), so any MagicINFO 9 server reachable from an untrusted network should be treated as a high-probability target and potentially already compromised until verified otherwise. The assessed vector (AV:N/AC:L/PR:N/UI:N) confirms that no credentials, user interaction, or special configuration are required - the only real precondition is that the server's interface is reachable by the attacker.
Kernel pointers are printed in the log file prior to SMR May-2023 Release 1 allows a privileged local attacker to bypass ASLR. Rated medium severity (CVSS 4.4), this vulnerability is low attack complexity. No vendor patch available.
Assuming radio permission is gained, missing input validation in modem interface driver prior to SMR Oct-2021 Release 1 results in format string bug leading to kernel panic. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
Lack of boundary checking of a buffer in set_skb_priv() of modem interface driver prior to SMR Oct-2021 Release 1 allows OOB read and it results in arbitrary code execution by dereference of invalid. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
A race condition in MFC charger driver prior to SMR MAY-2021 Release 1 allows local attackers to bypass signature check given a radio privilege is compromised. Rated medium severity (CVSS 6.4). No vendor patch available.
A use after free vulnerability via race condition in MFC charger driver prior to SMR MAY-2021 Release 1 allows arbitrary write given a radio privilege is compromised. Rated medium severity (CVSS 6.4). No vendor patch available.
An improper boundary check in DSP driver prior to SMR Mar-2021 Release 1 allows out of bounds memory access. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
A vulnerability in DSP driver prior to SMR Mar-2021 Release 1 allows attackers load arbitrary ELF libraries inside DSP. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
An incorrect implementation handling file descriptor in dpu driver prior to SMR Mar-2021 Release 1 results in memory corruption leading to kernel panic. Rated medium severity (CVSS 4.4), this vulnerability is low attack complexity. No vendor patch available.
An improper access control vulnerability in sec_log file prior to SMR MAR-2021 Release 1 exposes sensitive kernel information to userspace. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
Improper access control in clipboard service in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows untrusted applications to read or write certain local files. Rated high severity (CVSS 7.1), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Some Samsung devices include the SIMalliance Toolbox Browser (aka S@T Browser) on the UICC, which might allow remote attackers to retrieve location and IMEI information, or retrieve other data or. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Web Viewer 1.0.0.193 on Samsung SRN-1670D devices suffers from an Unrestricted file upload vulnerability: 'network_ssl_upload.php' allows remote authenticated attackers to upload and execute. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 74.7%.
Integer overflow in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 30.0%.
Web Viewer 1.0.0.193 on Samsung SRN-1670D devices allows remote attackers to read arbitrary files via a request to an unspecified PHP script. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 67.9%.
Multiple stack-based buffer overflows in the BackupToAvi method in the (1) UMS_Ctrl 1.5.1.1 and (2) UMS_Ctrl_STW 2.0.1.0 ActiveX controls in Samsung NET-i viewer 1.37.120316 allow remote attackers to. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 69.4%.
Local, high-privileged attackers can crash the Samsung Vyond TEE monitor by passing an out-of-bounds enclave ID to the Keystone SBI create_enclave path in tee/monitor/src/enclave.rs. The flaw affects all versions before commit be6e297b0c4836e20d73b2f8a40a561ea496ebaa and requires supervisor-mode access (PR:H) with no user interaction; impact is limited to availability (monitor crash/instability) with no confidentiality or integrity effect. No public exploit has been identified, and despite the CVE assignment, this is a genuinely low-priority issue.
Samsung Vyond's RISC-V security monitor aborts with an uncaught Rust panic when its SBI error paths are reached, because pre-fix builds call panic!() instead of returning a structured error code. Exploitation requires an attacker who already executes at RISC-V supervisor (S-mode) privilege and can invoke the monitor's SBI calls (enclave lifecycle or shared-memory region operations) with parameters that drive those functions into an error branch, making this a local, high-privilege, availability-only crash of a TEE security monitor. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV); CVSS 3.1 scores it 4.4 (AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H), with no confidentiality or integrity impact.
In the Linux kernel, the following vulnerability has been resolved: soc: samsung: exynos-pmu: fix use-after-free of interrupt generator node The setup_cpuhp_and_cpuidle() parses the device tree node for the interrupt generation block via of_parse_phandle() and decrements its reference count using of_node_put() immediately after fetching the resource address. However, later the intr_gen_node pointer is passed into of_syscon_register_regmap(). Fix this by declaring intr_gen_node with __free() and removing of_node_put().
Physical access to a device running Samsung Smart Switch earlier than 3.7.73 allows an attacker to install arbitrary applications, because the tool does not adequately verify the authenticity of the data it transfers or restores. The assessed CVSS 3.1 vector (AV:P/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N, 6.9 Medium) confirms that no authentication or user interaction is required once the attacker has the device in hand, but the mandatory physical-access precondition rules out remote or large-scale exploitation and confines realistic exposure to unattended, lost, stolen, or supply-chain-handled devices. There is no public exploit identified at time of analysis, and the condition is removed by updating Smart Switch to 3.7.73 or later.
Path traversal in Samsung Smart Switch prior to version 3.7.73 allows someone with physical access to the machine running the utility to reach files outside the intended working directory and read them with the privileges of the Smart Switch process. The vendor rates it CVSS 4.0 base 5.1 (medium), and our independent assessment scores it CVSS 3.1 5.1 with a physical attack vector (AV:P), no authentication and no user interaction required, which rules out remote or mass exploitation and confines realistic risk to lost, stolen, or otherwise physically controlled devices; devices updated to 3.7.73 or later are not affected. No public exploit code has been identified and the issue is not listed in CISA KEV, so it is not confirmed as actively exploited; a vendor patch exists (3.7.73).
Local information disclosure in Samsung Internet lets an attacker who already has access to the device read sensitive data through an improper access control weakness in all versions prior to 30.0.5.6. Samsung rates it CVSS 4.0 5.9 (AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N), and our independent assessment agrees: medium severity, local-only reach, confidentiality impact only, with no integrity or availability effect. No public exploit identified at time of analysis, so this is a moderate-priority patching item rather than an urgent one; the attack requires local access plus a specific precondition (AT:P) rather than working against every default invocation, but once met it needs no authentication or privileges (PR:N) and no user interaction (UI:N). Updating to 30.0.5.6 or later removes the flaw.
Samsung Flow builds prior to 4.9.22.4 contain an improper authentication weakness that lets an attacker on an adjacent wireless network reach sensitive information exchanged or stored by the app. Exploitation is unauthenticated and requires no user interaction (CVSS 4.0 PR:N/UI:N), but the vector also requires a specific precondition (AT:P) and proximity, so a successful attempt depends on timing or an active pairing/connection state rather than being reliably repeatable on demand. Severity is moderate (6.1 base) and no public exploit code or confirmed active exploitation was identified at time of analysis; realistic risk is constrained by the adjacent-network vector and the conditional attack requirement.
Local path traversal in Samsung Flow before version 4.9.22.1 allows an attacker who already has a foothold on the host device (Android or Windows) to escape the application's intended file boundaries and read clipboard contents. The attack requires local access - typically a malicious app installed on the same device or interactive access - with no authentication and no user interaction needed, but the impact is limited to disclosure of clipboard data with no effect on integrity or availability. There is no CISA KEV listing and no public exploit code identified at time of analysis, making this a genuinely moderate, low-urgency issue rather than a critical priority.
Samsung Internet versions prior to 30.0.5.24 are susceptible to script injection due to improper input validation, allowing unauthenticated remote attackers to compromise confidentiality of user data (CVSS 4.0 base 6.0). Exploitation requires passive user interaction (e.g., visiting a malicious page), and the assessed impact is limited to confidentiality (VC:H, VI:N, VA:N). The flaw was confirmed by Samsung's product security team; no public exploit has been identified at time of analysis.
Launching an arbitrary activity with Samsung Flow's own privileges is possible for a local attacker on a device running Samsung Flow prior to version 4.9.22.4, because the app ships with an incorrect default permission setting that exposes the capability to other local code on the device. Only users of the affected Samsung Flow builds on devices that are actually paired/connected to a counterpart device are exposed, and the resulting impact is bounded to the connected system with low confidentiality and integrity effect (vendor CVSS 4.0 base 2.1; our assessment CVSS 3.1 AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N). There is no indication of active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, and the presence of the AT:P attack-requirement in the vendor vector means a specific pairing/connection state must exist before exploitation is even feasible.
Improper input validation in the CreditCardRetrieveActivity component of Samsung Checkout prior to version 5.1.03.1 allows a locally installed malicious application to launch arbitrary activities with Samsung Checkout's own privileges, resulting in low-severity information disclosure and integrity impact. Exploitation is not remote: the attacker must already have code executing on the device, typically through a sideloaded or otherwise installed malicious app, and must be able to pass crafted input to the affected activity. There is no confirmed active exploitation and no public exploit code identified at time of analysis, and Samsung has shipped a fixed build (5.1.03.1) as documented in its mobile security bulletin.
Improper input validation in the GuestCreditCardRegisterActivity component of Samsung Checkout allows a malicious or malfunctioning app already installed on the same Samsung device to launch arbitrary activities with Samsung Checkout's privileges, giving limited unauthorized read and write impact (low confidentiality and integrity, no availability impact). Only Samsung Checkout builds prior to 5.1.03.1 are affected, and the flaw requires local on-device access from a separate app; it cannot be triggered remotely or over a network, and neither user interaction nor authentication is required once that local app is running. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); the medium-severity rating (CVSS 4.0 base 5.1, assessed CVSS 3.1 5.1) reflects that the mandatory prerequisite of pre-existing local code execution substantially narrows realistic exposure.
Local attackers who can run code on a Samsung device can exploit improper input validation in Samsung Checkout's CreditCardRegisterActivity to launch arbitrary activities using Samsung Checkout's own privileges, yielding low-level confidentiality and integrity exposure. The flaw affects Samsung Checkout versions prior to 5.1.03.1 and requires local code execution on the device, but no additional authentication or user interaction (CVSS:4.0 AV:L/AC:L/PR:N/UI:N, score 5.1; independently assessed as CVSS:3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; overall this is a medium-severity, locally-scoped issue with limited real-world urgency.
Samsung Account versions prior to 15.7.01.1 on Samsung Android devices expose an improperly exported application component that any other app installed on the same device can query to read sensitive account data. Exploitation requires a malicious or compromised local app already present on the device - there is no remote access, no user interaction, and no elevated privilege requirement per the CVSS vector (PR:N/UI:N) - making this a medium-severity local information-disclosure issue (CVSS 4.0 base 6.9). No public exploit code has been identified at time of analysis.
Out-of-bounds memory write in Samsung's HEIF decoder library (libsimba.heifdec.media.samsung.so) allows a local attacker to corrupt memory by supplying a crafted HEIF image to the cover-image decoding path. Only devices running builds prior to SMR Oct-2026 Release 1 are affected; the flaw is local (AV:L) but requires no privileges or user interaction once an app or process is present on the device, meaning a co-resident unprivileged application is sufficient. Impact is limited to integrity (no confidentiality or availability effect asserted), and no public exploit identified at time of analysis.
Local information disclosure in Samsung Locksettings (prior to SMR Oct-2026 Release 1) allows an attacker who already possesses root privilege on the device to read data belonging to a tied profile while the device is in the Before First Unlock (BFU) state. Exploitation is local-only (AV:L) and requires high privileges (PR:H), with no remote path; it does not enable privilege escalation, code execution, or data modification. No public exploit code exists, and the vulnerability is not listed in CISA KEV; EPSS data was not provided at time of analysis.
Local information disclosure in Samsung CmcCore allows a malicious or sideloaded application on a vulnerable handset to invoke privileged APIs because the component fails to enforce sufficient permission checks, exposing sensitive data with high confidentiality impact. Exploitation is strictly local-requiring code execution on the device-and affects firmware prior to SMR Oct-2026 Release 1; there is no remote vector and no integrity or availability impact. No public exploit identified at time of analysis, and CISA KEV does not list this CVE.
Local information disclosure in Samsung DownloadProvider allows an attacker-controlled Android application installed on a Samsung device to read files held in scoped storage that it should not be able to reach, yielding high confidentiality impact with only low integrity and availability impact. The flaw affects devices running firmware prior to the SMR Oct-2026 Release 1 maintenance release and requires no user interaction and no network access, because exploitation depends on a malicious app already running locally with low privileges. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited, making this a moderate-risk, local-only issue rather than a remotely triggerable emergency.
Local information disclosure in Samsung's CocktailBarService allows a malicious or compromised app already running on a Galaxy device to access sensitive data without additional user interaction or authentication. The flaw requires local code execution (AV:L) and affects Samsung builds prior to SMR Oct-2026 Release 1; no public exploit code has been identified at the time of analysis, and the confidentiality impact is limited (C:L). This is a moderate, locally-exploitable issue rather than a remote or high-severity threat.
Out-of-bounds write in Samsung Android's libsmkvextractor.so media parsing library allows a local attacker to corrupt memory by supplying a crafted Matroska (MKV) file, resulting in low integrity and availability impact. Affected are Samsung devices running firmware prior to SMR Oct-2026 Release 1; no public exploit code or active exploitation has been identified at time of analysis, and the CVSS 4.0 base score is 5.1 (medium). The attacker requires local access but no special privileges, and the flaw does not compromise confidentiality or change scope.
Out-of-bounds write in Samsung Android's libcodec2-sec-flacdec.so FLAC decoder allows a local attacker to write memory beyond the intended buffer, degrading integrity and availability of the affected device process. The issue affects devices running firmware prior to SMR Oct-2026 Release 1, and exploitation requires local access plus the ability to push attacker-controlled FLAC data into the codec path, typically through a malicious or compromised app. There is no public exploit identified at time of analysis, and the vendor-assigned CVSS 4.0 base score of 5.1 (bounded to low integrity and low availability impact with no confidentiality loss) places this in routine monthly-patch priority rather than emergency response.
Heap-based buffer overflow in Samsung rlottie (all versions at or before commit e57b094f03c39a751a1fded6f7d6c13f1ed95ec9) can crash an application that parses a crafted Lottie animation containing an embedded image asset with oversized dimensions, causing an undersized bitmap allocation followed by an out-of-bounds heap write. Exploitation requires local delivery and user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) - an unauthenticated local context, but the victim must actively open or render the malicious animation - and the impact is limited to availability (denial of service/crash), with no confidentiality or integrity effect assessed. No public exploit code identified at time of analysis, and no CISA KEV listing; EPSS score was not supplied in the available intelligence. Overall this is a genuine but modest-severity defect rather than an urgent priority.
In the Linux kernel, the following vulnerability has been resolved: drm/lima: call drm_mm_init() with a valid allocation range lima_vm_create() is currently run before va_start and va_end are set up, meaning they are both 0. lima_vm_create() runs drm_mm_init() with them as arguments for the allocator, and if DRM_DEBUG_MM is enabled the DRM_MM_BUG_ON check in drm_mm_init then fires, as seen here on exynos4412-odroid-u2: [ 1.736297] ------------[ cut here ]------------ [ 1.740370] kernel BUG at drivers/gpu/drm/drm_mm.c:931! [ 1.745574] Internal error: Oops - BUG: 0 [#1] SMP ARM [ 1.750697] Modules linked in: [ 1.753734] CPU: 0 UID: 0 PID: 41 Comm: kworker/u16:1 Not tainted 7.0.10-postmarketos-exynos4 #11 PREEMPT [ 1.763372] Hardware name: Samsung Exynos (Flattened Device Tree) [ 1.769446] Workqueue: events_unbound deferred_probe_work_func [ 1.775261] PC is at drm_mm_init+0x9c/0xa4 [ 1.779339] LR is at lima_vm_create+0x144/0x17c [ ... ] Fix the issue by moving the lima_vm_create() call after va_start and va_end are set up.
In the Linux kernel, the following vulnerability has been resolved: clocksource/drivers/samsung_pwm: Switch to raw_spinlock_t type Samsung PWM timer might be used as a clock source on some legacy systems. When PREEMPT_RT is enabled on ARM, regular spinlock is converted to a sleeping lock (mutex-based), which must not be used in atomic context such as hard interrupt handlers. Switch the samsung_pwm_lock to the raw_spinlock, which remains a true non-sleeping spinlock even under PREEMPT_RT.
A heap-based buffer overflow in the Samsung Escargot JavaScript engine is reachable when a crafted bytecode-cache file is parsed, driven by an integer wraparound (CWE-190) in the string-table length handling inside CodeCacheReader::loadStringTable. Exploitation requires local write access to the engine's bytecode-cache directory (CVSS 5.5, AV:L/PR:L), and the impact is limited to availability - a crash or memory-corruption-induced denial of service with no confidentiality or integrity loss. No public exploit code or CISA KEV listing was identified at time of analysis, and the upstream fix (Samsung PR #1650) adds a bounds check rejecting any maxLength above STRING_MAXIMUM_LENGTH.
Rendering a crafted Lottie vector animation with Samsung's open-source rLottie library can overflow a fixed-size stack buffer during run-length-encoding of render spans, corrupting memory in the host application. The flaw affects rLottie builds at revision 480a2ad0c5d2e45458c545b8213279e9e8b71e39 and is rated only 4.4 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) because an attacker must induce the victim application to render a malicious animation; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV. An upstream fix exists in Samsung/rlottie pull request 607, which increases the span array capacity and adds explicit bounds checks.
Untrusted pointer dereference in the camera driver of Samsung Exynos 1580 and 2500 mobile processors allows a local low-privileged attacker to cause denial of service or leak limited kernel information across security boundaries by sending a malformed message to the driver. The scope-changed CVSS vector (S:C) indicates impact extends beyond the immediate process context into privileged system components. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Out-of-bounds read in the Wi-Fi driver subsystem of Samsung Exynos mobile processors allows a local low-privileged attacker to leak kernel memory by sending a malformed Netlink command, potentially exposing sensitive in-kernel data. Affected processors span Samsung's mid-range and flagship mobile lineup plus wearable chips: Exynos 850, 1280, 1330, 1380, 1480, 2400, W920, and W930. No public exploit has been identified at time of analysis, and Samsung has published a product security advisory addressing the issue.
Out-of-bounds write in the Wi-Fi interface kernel driver of Samsung Exynos mobile and wearable processors enables a local low-privileged user to cause a denial of service through a crafted ioctl command. Affected SoCs include the Exynos 1330, 1380, 1480, 1580, 1680, W920, W930, and W1000, covering a broad range of Samsung Galaxy smartphones and Galaxy Watch devices. No public exploit has been identified, and the impact ceiling is a recoverable availability disruption with no confidentiality or integrity exposure.
Camera driver TOCTOU race condition across eight Samsung Exynos SoC families (1330, 1380, 1480, 2400, 1580, 2500, 2600, 1680) allows a local low-privileged attacker to trigger out-of-bounds memory access in the camera driver, resulting in limited availability impact. The vendor-assigned CVSS 3.1 score of 2.8 (AV:L/AC:H/PR:L) accurately captures the constrained real-world risk: exploitation requires winning a timing race from a local context with camera-level access. No public exploit code exists and the vulnerability is not listed in CISA KEV, confirming this as a low-urgency, patch-when-possible finding.
Out-of-bounds write in the Samsung Exynos camera driver error-handling path causes memory corruption on eight Exynos mobile processor variants. Exploitation requires local access with low privileges and high attack complexity to reach the faulty error path, with a changed scope producing only low availability impact - consistent with a crash or transient DoS rather than code execution. No public exploit code exists and the vendor has published a security update via the Samsung Semiconductor support portal.
Out-of-bounds write in the camera driver of Samsung Exynos processors (1330, 1380, 1480, 2400, 1580, and 2500) can be triggered by a local low-privileged attacker writing a malformed message to the debug sysfs entry `test_msg`, causing a denial-of-service condition in the camera subsystem. The vulnerability crosses a privilege boundary (scope changed) from user space into the camera driver, but impact is limited to availability and does not affect confidentiality or integrity. No public exploit code has been identified at time of analysis, and Samsung has published a security advisory addressing the issue.
Out-of-bounds memory access in Samsung's CustOS Driver on Exynos 1580 processors exposes a local low-privileged attacker to cross-TEE-boundary memory read and write primitives. The fault is triggered by submitting an oversized shared memory allocation request to the custos_iwc inter-world communication device, which the driver services without adequate bounds validation, potentially leaking secure-world data or corrupting CustOS runtime state. No public exploit code has been identified and CISA has not listed this in KEV at time of analysis.
NULL pointer dereference in the 5G NR baseband of Samsung Exynos processors and modems causes a denial-of-service condition when a malformed RRC Reconfiguration message is received from the network. Sixteen Exynos chip variants are affected, spanning Samsung flagship, mid-range, and wearable devices - including Exynos 850, 1080, 2100, 2200, 2400, W920, W930, W1000, Modem 5410, and others. An attacker capable of injecting or spoofing RRC layer signaling (e.g., via a rogue base station) can trigger a crash in the L2/RRC processing stack, disrupting cellular connectivity. No public exploit code or active exploitation has been identified at time of analysis.
Double-free in the Samsung Exynos Display Processing Unit (DPU) kernel driver allows a local low-privileged attacker to corrupt kernel heap memory and trigger a use-after-free condition across nine Exynos chip families spanning mid-range to flagship Samsung devices. Exploitation requires meeting a high-complexity timing condition during DMA buffer reallocation in the DPU driver, limiting practical attack surface despite the kernel-level impact. No public exploit code exists and this CVE has not been added to the CISA KEV catalog at the time of analysis.
OS command injection in the Samsung QA-Board backend allows unauthenticated remote attackers to execute arbitrary operating-system commands on the host running the service, yielding a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) with full confidentiality, integrity and availability impact. The flaw, classified as CWE-78, affects all versions matched by the wildcard CPE cpe:2.3:a:samsung_open_source:qa-board:*:*:*:*:*:*:*:*, so no release line is known to be exempt. No public exploit code has been identified at time of analysis and the issue is not listed on CISA KEV, but the trivial remote/unauthenticated attack profile makes rapid patching the priority.
Adjacent attackers can manipulate the mobile device connected to a Windows host running Samsung Continuity Service versions before 4.6.1217.0, with no authentication or user interaction needed once a paired session is active. Exploitation requires wireless proximity or local L2 adjacency and high attack complexity, and it can affect confidentiality, integrity, and availability across both the PC and the linked phone. No public exploit was identified at time of analysis, and the assessed risk is moderate rather than top-tier because the attacker must be near the target and the phone must be actively connected.
Local code execution in Samsung's HEIF decoder library (libsimba.heifdec.media.samsung.so) allows an unprivileged local attacker to execute arbitrary code by supplying a crafted HEIF image on devices running firmware prior to SMR Oct-2026 Release 1. The flaw is an improper input validation issue in the 'sheifd' parsing path, rated 8.6 (CVSS 4.0) with high confidentiality, integrity, and availability impact. No public exploit code has been identified at the time of analysis, and the local attack vector requires the malicious file to be delivered from an on-device context.
Local code execution in Samsung's HEIF decoder library (libsimba.heifdec.media.samsung.so) allows unprivileged attackers to run arbitrary code by supplying a crafted HEIF cover image. This improper input validation flaw, tracked as CVE-2026-21124, affects Samsung devices prior to the SMR Oct-2026 Release 1 security update and carries a CVSS 4.0 score of 8.6, indicating high confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis, and patched devices are not affected.
Local privilege escalation in Samsung's WSM service lets a malicious or compromised process already running on the device trigger a use-after-free and execute arbitrary code with system-level privileges. The flaw affects Samsung mobile firmware builds released before SMR Oct-2026 Release 1; remote network exploitation is not possible because the attacker must first have local code execution able to reach the WSM interface. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV), but the cross-boundary impact (scope change with high confidentiality, integrity and availability impact) makes prompt installation of the October 2026 security maintenance release the priority for any unpatched device.
Stack-based buffer overflow in the camera driver of Samsung Exynos mobile processors (1330, 1380, 1480, 1580, 1680, 2400, 2500, 2600) allows a local low-privileged attacker to crash the camera subsystem or corrupt adjacent kernel memory by sending a malformed message to the driver. The vendor's CVSS vector (S:C, I:H, A:H) indicates that impact extends beyond a simple denial of service to potential kernel-level integrity corruption, though the advisory text describes only DoS - this discrepancy suggests the stack overflow may be exploitable beyond a crash. No public exploit code or active exploitation (KEV) has been identified at time of analysis.
The MFC (Multi Format Codec) encoder driver in Samsung Exynos mobile and wearable processors contains a double-free vulnerability triggered by improper cleanup of dma_buf references during error handling paths. The flaw spans seventeen Exynos SoC variants - Exynos 850 through 2600 mobile series and W920/W930/W1000 wearable chips - present in Samsung Galaxy smartphones and Galaxy Watch devices, and can lead to kernel heap corruption with potential local privilege escalation to arbitrary kernel-mode code execution. No active exploitation has been confirmed (not listed in CISA KEV) and no public proof-of-concept is identified in the available input data.
Out-of-bounds write in Samsung's open-source Walrus WebAssembly runtime allows a crafted WASM component to corrupt process heap memory via a WASI 0.2 stream-read implementation flaw. The root cause is a `memcpy` in `WASI02Impl.cpp` that copies the requested read length (`size`) rather than the actual bytes read (`read`) from the buffer, writing beyond valid buffer bounds when a partial or short read occurs. A secondary defective bounds check for type-index validation in the WASM component parser compounds the attack surface. A proof-of-concept WASM file (`stream-read-oob-poc.wast`) was committed as part of the fix in PR #482, confirming exploitability; no public exploit independent of the fix has been identified at time of analysis.
Cross-container isolation bypass in proot-distro 5.1.5 and earlier (Termux) lets a crafted backup archive read and write files across otherwise isolated containers when a victim runs 'proot-distro restore'. Because the restore logic trusts the archive's hardlink 'linkname' to name the source container without verifying it matches the container being restored, an attacker who convinces a user to restore a malicious .tar can exfiltrate secrets (SSH keys, API credentials, databases) from one container into an attacker-controlled one, or inject attacker data into a different container. Publicly available exploit code exists (full PoCs are embedded in the GHSA advisory); no public active exploitation is known.
Out-of-bounds write in Samsung's Escargot JavaScript engine allows attacker-supplied scripts to corrupt memory through the ArrayBuffer.prototype.transfer() built-in, with high confidentiality, integrity, and availability impact (CVSS 8.8). The flaw stems from a missing length-bounds check when transferring an ArrayBuffer to a new byte length, enabling writes past the allocated buffer that can lead to remote code execution if a victim runs the malicious script. No public exploit has been identified at time of analysis, and no EPSS or CISA KEV data was provided.
Local privilege escalation and kernel memory corruption in the Linux kernel's Exynos DRM (drm/exynos) vidi driver allows a low-privileged local user to access arbitrary kernel memory by exploiting an unsafe user pointer dereference in vidi_connection_ioctl(). The flaw affects multiple kernel branches up to 6.18.14 and is fixed in stable releases 5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.77, 6.18.14, 6.19.4, and 7.0. No public exploit identified at time of analysis and EPSS exploitation probability is very low (0.02%, 7th percentile).
Local privilege escalation and memory corruption in the Linux kernel's Exynos DRM VIDI (Virtual Display) driver allows local users with access to the DRM device to trigger null pointer dereferences, garbage value accesses, out-of-bounds reads, or use-after-free conditions via the vidi_connection_ioctl() handler. The flaw stems from an incorrect device-to-context lookup that retrieves driver_data from the exynos-drm master device instead of the VIDI component device. A vendor patch is available across multiple stable branches, no public exploit identified at time of analysis, and EPSS rates exploitation probability at only 0.02%.
Uncontrolled recursion in Samsung's Escargot JavaScript engine triggers excessive heap allocation, causing a denial-of-service condition with high availability impact. The vulnerability affects the specific commit 590345cc6258317c5da850d846ce6baaf2afc2d3 of the Escargot engine, which is deployed in Samsung smart TV and appliance firmware. No public exploit code exists and no active exploitation is confirmed by CISA KEV; however, the fix PR reveals multiple heap exhaustion and integer underflow scenarios addressable through crafted JavaScript inputs.
Denial of service in Samsung Escargot JavaScript engine at commit 590345cc6258317c5da850d846ce6baaf2afc2d3 stems from multiple improper exceptional-condition handling paths exposed during JavaScript execution: a null pointer dereference when resolving error values in nested eval/throw/finally scenarios, an integer underflow in TypedArray.copyWithin() triggered by resizable ArrayBuffer coercion, and an unguarded assertion failure when array objects transition unexpectedly from fast to slow mode. Attack vector is local and requires user interaction (UI:R), with impact confined entirely to availability - crashing the host process. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Denial-of-service in Samsung's Escargot JavaScript engine (commit 590345cc) stems from multiple unhandled exceptional conditions - including a null error-value dereference during nested eval/throw/finally sequences, integer underflow in TypedArray.copyWithin after runtime buffer resize, an unhandled out-of-memory condition in the garbage collector, and an invalid fast-mode array assertion during spread operations. Exploitation requires local access and user interaction (AV:L/UI:R per CVSS), crashing or aborting the Escargot runtime process. No public exploit code or CISA KEV listing exists at time of analysis; an upstream fix is available as GitHub PR #1565 but no tagged release version has been confirmed.
Out-of-bounds write in Samsung's Escargot lightweight JavaScript engine (commit 590345cc6258317c5da850d846ce6baaf2afc2d3) allows attackers to corrupt memory by inducing buffer overflows through crafted JavaScript. Exploitation requires local execution of attacker-supplied script content with user interaction, but successful triggering yields high impact to confidentiality, integrity, and availability (CVSS 7.8). No public exploit identified at time of analysis and the issue is not on the CISA KEV list.
Excessive memory allocation in Samsung's Escargot JavaScript engine (commit 590345cc) triggers a denial-of-service condition via integer underflow in the TypedArray.prototype.copyWithin implementation, causing the engine to request a massive heap allocation and subsequently abort the process. Affected deployments include Samsung TV and appliance firmware that embeds Escargot as a scripting runtime. No public exploit code and no CISA KEV listing are present; EPSS data was not provided in available intelligence. Risk is bounded by the local attack vector and user interaction requirement in the CVSS vector.
Denial-of-service via invalid pointer dereference in Samsung Open Source Escargot JavaScript engine affects the specific commit 590345cc6258317c5da850d846ce6baaf2afc2d3, allowing a locally-present attacker to crash the runtime through crafted JavaScript. The root cause (CWE-763) involves unconditional dereference of a potentially invalid or null error pointer in the resultOrErrorToString path, triggerable via nested eval/throw/finally patterns that induce GC allocation during exception handling. No public exploit code exists and no CISA KEV listing is present at time of analysis.
Heap-based buffer overflow in Samsung's Escargot JavaScript engine (commit 590345cc6258317c5da850d846ce6baaf2afc2d3) allows remote attackers to corrupt heap memory and likely achieve arbitrary code execution when a victim processes attacker-controlled JavaScript. No public exploit identified at time of analysis, but the upstream fix (PR #1565) reveals multiple memory-safety hardening changes including integer underflow protection in TypedArray.copyWithin, fast-mode array conversion checks during spread operations, and OOM handling, indicating concrete reachable corruption paths. CVSS 7.8 with local attack vector and required user interaction reflects the engine's typical embedding context (apps, IoT, smart TV runtimes) rather than network-facing services.
Use-after-free memory corruption in Samsung's Escargot JavaScript engine (commit 590345cc6258317c5da850d846ce6baaf2afc2d3) enables pointer manipulation when processing crafted JavaScript content, with CVSS 7.8 reflecting high-impact local exploitation requiring user interaction. The affected codepaths include evaluator error handling, TypedArray copyWithin operations on resizable buffers, DataView coercion, and array fast-mode transitions - all triggerable by attacker-controlled script. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Uncontrolled recursion in Samsung's Escargot JavaScript engine crashes the runtime when processing oversized serialized data payloads, resulting in a high-severity availability impact. The vulnerability is confirmed at commit 590345cc6258317c5da850d846ce6baaf2afc2d3 of the Escargot engine, which is deployed in Samsung TV and appliance platforms. An attacker who can cause a local user to open or execute a crafted JavaScript payload can trigger a stack overflow, denying service to the affected application or device; no public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
NULL pointer dereference in Samsung's open-source Walrus WebAssembly runtime crashes the parser when processing malformed WASM binaries, resulting in denial of service. The vulnerability exists in the WASMBinaryReader component (WASMParser.cpp) at commit f339b8ee4ea701772e8ae640b3d1b12ac02b1ae9, where multiple error-handling code paths fail to return early, allowing execution to continue past invalid state and dereference null pointers. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
NULL pointer dereference in Samsung Open Source Walrus's WebAssembly binary parser causes application-level denial of service when a crafted .wasm module containing deeply nested instructions is loaded. The vulnerability affects the Walrus runtime at commit f339b8ee4ea701772e8ae640b3d1b12ac02b1ae9 (CPE: cpe:2.3:a:samsung_open_source:walrus) and is classified CVSS 5.5 Medium with a local attack vector requiring user interaction. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; an upstream fix is available in GitHub PR #409 but a tagged release version has not been independently confirmed.
Integer overflow in Samsung Escargot JavaScript engine allows remote attackers to trigger buffer overflows without authentication via network-delivered crafted JavaScript code. Affects commit 97e8115ab and prior versions. No public exploit identified at time of analysis, though upstream fix available (PR/commit); released patched version not independently confirmed. With CVSS 8.1 (High) and network attack vector requiring high complexity, this represents significant risk for devices and applications embedding the Escargot engine, particularly Samsung smart TV and appliance platforms.
Out-of-bounds write in Samsung Open Source Escargot JavaScript engine allows local attackers to execute arbitrary code or corrupt memory through buffer overflow conditions. This vulnerability affects Escargot commit 97e8115ab1110bc502b4b5e4a0c689a71520d335 and prior versions. With a 7.4 CVSS score (high confidentiality, integrity, and availability impact) but high attack complexity and local attack vector, exploitation requires specialized conditions. No public exploit identified at time of analysis, and EPSS data not available for this CVE.
Heap-based buffer overflow in Samsung Open Source Escargot JavaScript engine enables out-of-bounds memory writes with high integrity and availability impact through local attack vectors. Affects Escargot commit 97e8115ab1110bc502b4b5e4a0c689a71520d335. CVSS 8.1 severity driven by scope change and low attack complexity despite local access requirement. Upstream fix available (PR/commit); released patched version not independently confirmed. No public exploit identified at time of analysis, and exploitation requires high attack complexity (AC:H), limiting immediate risk despite elevated CVSS score.
Local privilege escalation in Samsung MagicINFO 9 Server versions prior to 21.1091.1 enables authenticated low-privileged users to escalate to high privileges through incorrect default file/directory permissions. Attackers with local access can obtain complete system control, compromising confidentiality, integrity, and availability. Attack requires local access and low-level authentication but no user interaction. No public exploit identified at time of analysis.
Use-after-free in Linux kernel's Exynos Virtual Display (drm/exynos vidi) driver allows local authenticated users to potentially execute arbitrary code, escalate privileges, or cause denial of service. The vulnerability stems from missing lock protection during concurrent memory allocation/deallocation operations in the vidi_context structure. EPSS score of 0.02% indicates low observed exploitation probability. Vendor patches available across multiple kernel stable branches.
Android versions up to 14.0 contains a vulnerability that allows attackers to launch arbitrary activity with Samsung Dialer privilege (CVSS 7.8).
Android versions up to 15.0 contains a vulnerability that allows attackers to launch arbitrary activity with Settings privilege (CVSS 7.8).
Hardcoded database credentials in Samsung MagicInfo9 Server allow direct database access and manipulation.
Remote code execution in MagicInfo 9 Server (versions prior to 21.1090.1) allows unauthenticated attackers to upload arbitrary files without authentication, resulting in complete system compromise with high confidentiality, integrity, and availability impact. The vulnerability enables privilege escalation and requires only user interaction to trigger. No patch is currently available for this critical flaw affecting all vulnerable MagicInfo 9 Server installations.
Unauthenticated file upload leading to stored XSS and potential RCE in Samsung MagicInfo9 Server. HTML files uploaded without authentication.
Galaxy Store versions up to 4.6.02 contains a vulnerability that allows attackers to execute arbitrary script (CVSS 7.8).
Arbitrary code execution in the Android PROCA driver before the January 2026 security update results from a use-after-free vulnerability accessible to local attackers with basic privileges. An attacker with local access can exploit this memory safety flaw to execute arbitrary code with elevated privileges on affected devices. No patch is currently available for this high-severity vulnerability.
Android versions up to 15.0 contains a vulnerability that allows attackers to execute the privileged APIs (CVSS 7.8).
Remote code execution in Samsung Android's Quram image codec (libimagecodec.quram.so) allows unauthenticated attackers to execute arbitrary code on affected devices running Android 13.0 with SMR levels prior to Sep-2025 Release 1 by supplying a crafted image. This is confirmed actively exploited (CISA KEV), and exploitation requires no authentication or user interaction, though the malicious image must reach an auto-decoding path such as messaging previews or thumbnail generation; code execution occurs in the context of the invoking component. EPSS is 4.91% (90th percentile), indicating elevated risk, and the CVSS is 9.8.
Remote code execution in Samsung Android 13's Quram image codec (libimagecodec.quram.so) allows unauthenticated, zero-click attackers to corrupt memory by having the device decode a crafted image, per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector scoring 9.8. The flaw is confirmed actively exploited (CISA KEV) and was observed in the wild as part of the LANDFALL commercial-grade Android spyware chain, with EPSS at 1.84% (83rd percentile) - low in absolute terms but elevated in rank, consistent with targeted rather than mass exploitation. Only devices running Samsung Android 13 builds with security patch levels prior to SMR Apr-2025 Release 1 are affected, and exploitation in the wild has been selective, so the primary exposure driver is unpatched devices still receiving/dismissing images through messaging and media pipelines.
Samsung MagicINFO 9 Server contains a path traversal vulnerability allowing unauthenticated attackers to write arbitrary files as SYSTEM authority, enabling complete server compromise.
Remote, unauthenticated attackers can write files of their choosing with system-level authority on Samsung MagicINFO 9 Server installations running any version before 21.1050, abusing a pathname-restriction failure that lets crafted paths escape the directory the application intends to confine writes to. The vulnerability is confirmed actively exploited (CISA KEV), publicly available exploit code exists, and EPSS stands at 71.0% (99th percentile), so any MagicINFO 9 server reachable from an untrusted network should be treated as a high-probability target and potentially already compromised until verified otherwise. The assessed vector (AV:N/AC:L/PR:N/UI:N) confirms that no credentials, user interaction, or special configuration are required - the only real precondition is that the server's interface is reachable by the attacker.
Kernel pointers are printed in the log file prior to SMR May-2023 Release 1 allows a privileged local attacker to bypass ASLR. Rated medium severity (CVSS 4.4), this vulnerability is low attack complexity. No vendor patch available.
Assuming radio permission is gained, missing input validation in modem interface driver prior to SMR Oct-2021 Release 1 results in format string bug leading to kernel panic. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
Lack of boundary checking of a buffer in set_skb_priv() of modem interface driver prior to SMR Oct-2021 Release 1 allows OOB read and it results in arbitrary code execution by dereference of invalid. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
A race condition in MFC charger driver prior to SMR MAY-2021 Release 1 allows local attackers to bypass signature check given a radio privilege is compromised. Rated medium severity (CVSS 6.4). No vendor patch available.
A use after free vulnerability via race condition in MFC charger driver prior to SMR MAY-2021 Release 1 allows arbitrary write given a radio privilege is compromised. Rated medium severity (CVSS 6.4). No vendor patch available.
An improper boundary check in DSP driver prior to SMR Mar-2021 Release 1 allows out of bounds memory access. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
A vulnerability in DSP driver prior to SMR Mar-2021 Release 1 allows attackers load arbitrary ELF libraries inside DSP. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
An incorrect implementation handling file descriptor in dpu driver prior to SMR Mar-2021 Release 1 results in memory corruption leading to kernel panic. Rated medium severity (CVSS 4.4), this vulnerability is low attack complexity. No vendor patch available.
An improper access control vulnerability in sec_log file prior to SMR MAR-2021 Release 1 exposes sensitive kernel information to userspace. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
Improper access control in clipboard service in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows untrusted applications to read or write certain local files. Rated high severity (CVSS 7.1), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Some Samsung devices include the SIMalliance Toolbox Browser (aka S@T Browser) on the UICC, which might allow remote attackers to retrieve location and IMEI information, or retrieve other data or. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Web Viewer 1.0.0.193 on Samsung SRN-1670D devices suffers from an Unrestricted file upload vulnerability: 'network_ssl_upload.php' allows remote authenticated attackers to upload and execute. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 74.7%.
Integer overflow in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 30.0%.
Web Viewer 1.0.0.193 on Samsung SRN-1670D devices allows remote attackers to read arbitrary files via a request to an unspecified PHP script. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 67.9%.
Multiple stack-based buffer overflows in the BackupToAvi method in the (1) UMS_Ctrl 1.5.1.1 and (2) UMS_Ctrl_STW 2.0.1.0 ActiveX controls in Samsung NET-i viewer 1.37.120316 allow remote attackers to. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 69.4%.
Local, high-privileged attackers can crash the Samsung Vyond TEE monitor by passing an out-of-bounds enclave ID to the Keystone SBI create_enclave path in tee/monitor/src/enclave.rs. The flaw affects all versions before commit be6e297b0c4836e20d73b2f8a40a561ea496ebaa and requires supervisor-mode access (PR:H) with no user interaction; impact is limited to availability (monitor crash/instability) with no confidentiality or integrity effect. No public exploit has been identified, and despite the CVE assignment, this is a genuinely low-priority issue.
Samsung Vyond's RISC-V security monitor aborts with an uncaught Rust panic when its SBI error paths are reached, because pre-fix builds call panic!() instead of returning a structured error code. Exploitation requires an attacker who already executes at RISC-V supervisor (S-mode) privilege and can invoke the monitor's SBI calls (enclave lifecycle or shared-memory region operations) with parameters that drive those functions into an error branch, making this a local, high-privilege, availability-only crash of a TEE security monitor. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV); CVSS 3.1 scores it 4.4 (AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H), with no confidentiality or integrity impact.
In the Linux kernel, the following vulnerability has been resolved: soc: samsung: exynos-pmu: fix use-after-free of interrupt generator node The setup_cpuhp_and_cpuidle() parses the device tree node for the interrupt generation block via of_parse_phandle() and decrements its reference count using of_node_put() immediately after fetching the resource address. However, later the intr_gen_node pointer is passed into of_syscon_register_regmap(). Fix this by declaring intr_gen_node with __free() and removing of_node_put().
Physical access to a device running Samsung Smart Switch earlier than 3.7.73 allows an attacker to install arbitrary applications, because the tool does not adequately verify the authenticity of the data it transfers or restores. The assessed CVSS 3.1 vector (AV:P/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N, 6.9 Medium) confirms that no authentication or user interaction is required once the attacker has the device in hand, but the mandatory physical-access precondition rules out remote or large-scale exploitation and confines realistic exposure to unattended, lost, stolen, or supply-chain-handled devices. There is no public exploit identified at time of analysis, and the condition is removed by updating Smart Switch to 3.7.73 or later.
Path traversal in Samsung Smart Switch prior to version 3.7.73 allows someone with physical access to the machine running the utility to reach files outside the intended working directory and read them with the privileges of the Smart Switch process. The vendor rates it CVSS 4.0 base 5.1 (medium), and our independent assessment scores it CVSS 3.1 5.1 with a physical attack vector (AV:P), no authentication and no user interaction required, which rules out remote or mass exploitation and confines realistic risk to lost, stolen, or otherwise physically controlled devices; devices updated to 3.7.73 or later are not affected. No public exploit code has been identified and the issue is not listed in CISA KEV, so it is not confirmed as actively exploited; a vendor patch exists (3.7.73).
Local information disclosure in Samsung Internet lets an attacker who already has access to the device read sensitive data through an improper access control weakness in all versions prior to 30.0.5.6. Samsung rates it CVSS 4.0 5.9 (AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N), and our independent assessment agrees: medium severity, local-only reach, confidentiality impact only, with no integrity or availability effect. No public exploit identified at time of analysis, so this is a moderate-priority patching item rather than an urgent one; the attack requires local access plus a specific precondition (AT:P) rather than working against every default invocation, but once met it needs no authentication or privileges (PR:N) and no user interaction (UI:N). Updating to 30.0.5.6 or later removes the flaw.
Samsung Flow builds prior to 4.9.22.4 contain an improper authentication weakness that lets an attacker on an adjacent wireless network reach sensitive information exchanged or stored by the app. Exploitation is unauthenticated and requires no user interaction (CVSS 4.0 PR:N/UI:N), but the vector also requires a specific precondition (AT:P) and proximity, so a successful attempt depends on timing or an active pairing/connection state rather than being reliably repeatable on demand. Severity is moderate (6.1 base) and no public exploit code or confirmed active exploitation was identified at time of analysis; realistic risk is constrained by the adjacent-network vector and the conditional attack requirement.
Local path traversal in Samsung Flow before version 4.9.22.1 allows an attacker who already has a foothold on the host device (Android or Windows) to escape the application's intended file boundaries and read clipboard contents. The attack requires local access - typically a malicious app installed on the same device or interactive access - with no authentication and no user interaction needed, but the impact is limited to disclosure of clipboard data with no effect on integrity or availability. There is no CISA KEV listing and no public exploit code identified at time of analysis, making this a genuinely moderate, low-urgency issue rather than a critical priority.
Samsung Internet versions prior to 30.0.5.24 are susceptible to script injection due to improper input validation, allowing unauthenticated remote attackers to compromise confidentiality of user data (CVSS 4.0 base 6.0). Exploitation requires passive user interaction (e.g., visiting a malicious page), and the assessed impact is limited to confidentiality (VC:H, VI:N, VA:N). The flaw was confirmed by Samsung's product security team; no public exploit has been identified at time of analysis.
Launching an arbitrary activity with Samsung Flow's own privileges is possible for a local attacker on a device running Samsung Flow prior to version 4.9.22.4, because the app ships with an incorrect default permission setting that exposes the capability to other local code on the device. Only users of the affected Samsung Flow builds on devices that are actually paired/connected to a counterpart device are exposed, and the resulting impact is bounded to the connected system with low confidentiality and integrity effect (vendor CVSS 4.0 base 2.1; our assessment CVSS 3.1 AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N). There is no indication of active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, and the presence of the AT:P attack-requirement in the vendor vector means a specific pairing/connection state must exist before exploitation is even feasible.
Improper input validation in the CreditCardRetrieveActivity component of Samsung Checkout prior to version 5.1.03.1 allows a locally installed malicious application to launch arbitrary activities with Samsung Checkout's own privileges, resulting in low-severity information disclosure and integrity impact. Exploitation is not remote: the attacker must already have code executing on the device, typically through a sideloaded or otherwise installed malicious app, and must be able to pass crafted input to the affected activity. There is no confirmed active exploitation and no public exploit code identified at time of analysis, and Samsung has shipped a fixed build (5.1.03.1) as documented in its mobile security bulletin.
Improper input validation in the GuestCreditCardRegisterActivity component of Samsung Checkout allows a malicious or malfunctioning app already installed on the same Samsung device to launch arbitrary activities with Samsung Checkout's privileges, giving limited unauthorized read and write impact (low confidentiality and integrity, no availability impact). Only Samsung Checkout builds prior to 5.1.03.1 are affected, and the flaw requires local on-device access from a separate app; it cannot be triggered remotely or over a network, and neither user interaction nor authentication is required once that local app is running. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); the medium-severity rating (CVSS 4.0 base 5.1, assessed CVSS 3.1 5.1) reflects that the mandatory prerequisite of pre-existing local code execution substantially narrows realistic exposure.
Local attackers who can run code on a Samsung device can exploit improper input validation in Samsung Checkout's CreditCardRegisterActivity to launch arbitrary activities using Samsung Checkout's own privileges, yielding low-level confidentiality and integrity exposure. The flaw affects Samsung Checkout versions prior to 5.1.03.1 and requires local code execution on the device, but no additional authentication or user interaction (CVSS:4.0 AV:L/AC:L/PR:N/UI:N, score 5.1; independently assessed as CVSS:3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; overall this is a medium-severity, locally-scoped issue with limited real-world urgency.
Samsung Account versions prior to 15.7.01.1 on Samsung Android devices expose an improperly exported application component that any other app installed on the same device can query to read sensitive account data. Exploitation requires a malicious or compromised local app already present on the device - there is no remote access, no user interaction, and no elevated privilege requirement per the CVSS vector (PR:N/UI:N) - making this a medium-severity local information-disclosure issue (CVSS 4.0 base 6.9). No public exploit code has been identified at time of analysis.
Out-of-bounds memory write in Samsung's HEIF decoder library (libsimba.heifdec.media.samsung.so) allows a local attacker to corrupt memory by supplying a crafted HEIF image to the cover-image decoding path. Only devices running builds prior to SMR Oct-2026 Release 1 are affected; the flaw is local (AV:L) but requires no privileges or user interaction once an app or process is present on the device, meaning a co-resident unprivileged application is sufficient. Impact is limited to integrity (no confidentiality or availability effect asserted), and no public exploit identified at time of analysis.
Local information disclosure in Samsung Locksettings (prior to SMR Oct-2026 Release 1) allows an attacker who already possesses root privilege on the device to read data belonging to a tied profile while the device is in the Before First Unlock (BFU) state. Exploitation is local-only (AV:L) and requires high privileges (PR:H), with no remote path; it does not enable privilege escalation, code execution, or data modification. No public exploit code exists, and the vulnerability is not listed in CISA KEV; EPSS data was not provided at time of analysis.
Local information disclosure in Samsung CmcCore allows a malicious or sideloaded application on a vulnerable handset to invoke privileged APIs because the component fails to enforce sufficient permission checks, exposing sensitive data with high confidentiality impact. Exploitation is strictly local-requiring code execution on the device-and affects firmware prior to SMR Oct-2026 Release 1; there is no remote vector and no integrity or availability impact. No public exploit identified at time of analysis, and CISA KEV does not list this CVE.
Local information disclosure in Samsung DownloadProvider allows an attacker-controlled Android application installed on a Samsung device to read files held in scoped storage that it should not be able to reach, yielding high confidentiality impact with only low integrity and availability impact. The flaw affects devices running firmware prior to the SMR Oct-2026 Release 1 maintenance release and requires no user interaction and no network access, because exploitation depends on a malicious app already running locally with low privileges. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited, making this a moderate-risk, local-only issue rather than a remotely triggerable emergency.
Local information disclosure in Samsung's CocktailBarService allows a malicious or compromised app already running on a Galaxy device to access sensitive data without additional user interaction or authentication. The flaw requires local code execution (AV:L) and affects Samsung builds prior to SMR Oct-2026 Release 1; no public exploit code has been identified at the time of analysis, and the confidentiality impact is limited (C:L). This is a moderate, locally-exploitable issue rather than a remote or high-severity threat.
Out-of-bounds write in Samsung Android's libsmkvextractor.so media parsing library allows a local attacker to corrupt memory by supplying a crafted Matroska (MKV) file, resulting in low integrity and availability impact. Affected are Samsung devices running firmware prior to SMR Oct-2026 Release 1; no public exploit code or active exploitation has been identified at time of analysis, and the CVSS 4.0 base score is 5.1 (medium). The attacker requires local access but no special privileges, and the flaw does not compromise confidentiality or change scope.
Out-of-bounds write in Samsung Android's libcodec2-sec-flacdec.so FLAC decoder allows a local attacker to write memory beyond the intended buffer, degrading integrity and availability of the affected device process. The issue affects devices running firmware prior to SMR Oct-2026 Release 1, and exploitation requires local access plus the ability to push attacker-controlled FLAC data into the codec path, typically through a malicious or compromised app. There is no public exploit identified at time of analysis, and the vendor-assigned CVSS 4.0 base score of 5.1 (bounded to low integrity and low availability impact with no confidentiality loss) places this in routine monthly-patch priority rather than emergency response.
Heap-based buffer overflow in Samsung rlottie (all versions at or before commit e57b094f03c39a751a1fded6f7d6c13f1ed95ec9) can crash an application that parses a crafted Lottie animation containing an embedded image asset with oversized dimensions, causing an undersized bitmap allocation followed by an out-of-bounds heap write. Exploitation requires local delivery and user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) - an unauthenticated local context, but the victim must actively open or render the malicious animation - and the impact is limited to availability (denial of service/crash), with no confidentiality or integrity effect assessed. No public exploit code identified at time of analysis, and no CISA KEV listing; EPSS score was not supplied in the available intelligence. Overall this is a genuine but modest-severity defect rather than an urgent priority.
In the Linux kernel, the following vulnerability has been resolved: drm/lima: call drm_mm_init() with a valid allocation range lima_vm_create() is currently run before va_start and va_end are set up, meaning they are both 0. lima_vm_create() runs drm_mm_init() with them as arguments for the allocator, and if DRM_DEBUG_MM is enabled the DRM_MM_BUG_ON check in drm_mm_init then fires, as seen here on exynos4412-odroid-u2: [ 1.736297] ------------[ cut here ]------------ [ 1.740370] kernel BUG at drivers/gpu/drm/drm_mm.c:931! [ 1.745574] Internal error: Oops - BUG: 0 [#1] SMP ARM [ 1.750697] Modules linked in: [ 1.753734] CPU: 0 UID: 0 PID: 41 Comm: kworker/u16:1 Not tainted 7.0.10-postmarketos-exynos4 #11 PREEMPT [ 1.763372] Hardware name: Samsung Exynos (Flattened Device Tree) [ 1.769446] Workqueue: events_unbound deferred_probe_work_func [ 1.775261] PC is at drm_mm_init+0x9c/0xa4 [ 1.779339] LR is at lima_vm_create+0x144/0x17c [ ... ] Fix the issue by moving the lima_vm_create() call after va_start and va_end are set up.
In the Linux kernel, the following vulnerability has been resolved: clocksource/drivers/samsung_pwm: Switch to raw_spinlock_t type Samsung PWM timer might be used as a clock source on some legacy systems. When PREEMPT_RT is enabled on ARM, regular spinlock is converted to a sleeping lock (mutex-based), which must not be used in atomic context such as hard interrupt handlers. Switch the samsung_pwm_lock to the raw_spinlock, which remains a true non-sleeping spinlock even under PREEMPT_RT.
A heap-based buffer overflow in the Samsung Escargot JavaScript engine is reachable when a crafted bytecode-cache file is parsed, driven by an integer wraparound (CWE-190) in the string-table length handling inside CodeCacheReader::loadStringTable. Exploitation requires local write access to the engine's bytecode-cache directory (CVSS 5.5, AV:L/PR:L), and the impact is limited to availability - a crash or memory-corruption-induced denial of service with no confidentiality or integrity loss. No public exploit code or CISA KEV listing was identified at time of analysis, and the upstream fix (Samsung PR #1650) adds a bounds check rejecting any maxLength above STRING_MAXIMUM_LENGTH.
Rendering a crafted Lottie vector animation with Samsung's open-source rLottie library can overflow a fixed-size stack buffer during run-length-encoding of render spans, corrupting memory in the host application. The flaw affects rLottie builds at revision 480a2ad0c5d2e45458c545b8213279e9e8b71e39 and is rated only 4.4 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) because an attacker must induce the victim application to render a malicious animation; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV. An upstream fix exists in Samsung/rlottie pull request 607, which increases the span array capacity and adds explicit bounds checks.
Untrusted pointer dereference in the camera driver of Samsung Exynos 1580 and 2500 mobile processors allows a local low-privileged attacker to cause denial of service or leak limited kernel information across security boundaries by sending a malformed message to the driver. The scope-changed CVSS vector (S:C) indicates impact extends beyond the immediate process context into privileged system components. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Out-of-bounds read in the Wi-Fi driver subsystem of Samsung Exynos mobile processors allows a local low-privileged attacker to leak kernel memory by sending a malformed Netlink command, potentially exposing sensitive in-kernel data. Affected processors span Samsung's mid-range and flagship mobile lineup plus wearable chips: Exynos 850, 1280, 1330, 1380, 1480, 2400, W920, and W930. No public exploit has been identified at time of analysis, and Samsung has published a product security advisory addressing the issue.
Out-of-bounds write in the Wi-Fi interface kernel driver of Samsung Exynos mobile and wearable processors enables a local low-privileged user to cause a denial of service through a crafted ioctl command. Affected SoCs include the Exynos 1330, 1380, 1480, 1580, 1680, W920, W930, and W1000, covering a broad range of Samsung Galaxy smartphones and Galaxy Watch devices. No public exploit has been identified, and the impact ceiling is a recoverable availability disruption with no confidentiality or integrity exposure.
Camera driver TOCTOU race condition across eight Samsung Exynos SoC families (1330, 1380, 1480, 2400, 1580, 2500, 2600, 1680) allows a local low-privileged attacker to trigger out-of-bounds memory access in the camera driver, resulting in limited availability impact. The vendor-assigned CVSS 3.1 score of 2.8 (AV:L/AC:H/PR:L) accurately captures the constrained real-world risk: exploitation requires winning a timing race from a local context with camera-level access. No public exploit code exists and the vulnerability is not listed in CISA KEV, confirming this as a low-urgency, patch-when-possible finding.
Out-of-bounds write in the Samsung Exynos camera driver error-handling path causes memory corruption on eight Exynos mobile processor variants. Exploitation requires local access with low privileges and high attack complexity to reach the faulty error path, with a changed scope producing only low availability impact - consistent with a crash or transient DoS rather than code execution. No public exploit code exists and the vendor has published a security update via the Samsung Semiconductor support portal.
Out-of-bounds write in the camera driver of Samsung Exynos processors (1330, 1380, 1480, 2400, 1580, and 2500) can be triggered by a local low-privileged attacker writing a malformed message to the debug sysfs entry `test_msg`, causing a denial-of-service condition in the camera subsystem. The vulnerability crosses a privilege boundary (scope changed) from user space into the camera driver, but impact is limited to availability and does not affect confidentiality or integrity. No public exploit code has been identified at time of analysis, and Samsung has published a security advisory addressing the issue.
Out-of-bounds memory access in Samsung's CustOS Driver on Exynos 1580 processors exposes a local low-privileged attacker to cross-TEE-boundary memory read and write primitives. The fault is triggered by submitting an oversized shared memory allocation request to the custos_iwc inter-world communication device, which the driver services without adequate bounds validation, potentially leaking secure-world data or corrupting CustOS runtime state. No public exploit code has been identified and CISA has not listed this in KEV at time of analysis.
NULL pointer dereference in the 5G NR baseband of Samsung Exynos processors and modems causes a denial-of-service condition when a malformed RRC Reconfiguration message is received from the network. Sixteen Exynos chip variants are affected, spanning Samsung flagship, mid-range, and wearable devices - including Exynos 850, 1080, 2100, 2200, 2400, W920, W930, W1000, Modem 5410, and others. An attacker capable of injecting or spoofing RRC layer signaling (e.g., via a rogue base station) can trigger a crash in the L2/RRC processing stack, disrupting cellular connectivity. No public exploit code or active exploitation has been identified at time of analysis.
Double-free in the Samsung Exynos Display Processing Unit (DPU) kernel driver allows a local low-privileged attacker to corrupt kernel heap memory and trigger a use-after-free condition across nine Exynos chip families spanning mid-range to flagship Samsung devices. Exploitation requires meeting a high-complexity timing condition during DMA buffer reallocation in the DPU driver, limiting practical attack surface despite the kernel-level impact. No public exploit code exists and this CVE has not been added to the CISA KEV catalog at the time of analysis.