32
CVEs
0
Critical
3
High
0
KEV
0
PoC
3
Unpatched C/H
15.6%
Patch Rate
0.1%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
3
MEDIUM
19
LOW
9
Monthly CVE Trend
Affected Products (30)
Android
599
Exynos 1380 Firmware
107
Exynos 1280 Firmware
104
Exynos 980 Firmware
95
Exynos 1330 Firmware
85
Exynos 1080 Firmware
82
Exynos 850 Firmware
80
Exynos 1480 Firmware
77
Exynos 2200 Firmware
75
Exynos 2400 Firmware
66
Exynos W920 Firmware
60
Notes
57
Samsung Open Source
52
Exynos 2100 Firmware
52
Samsung Mobile
50
Exynos W930 Firmware
50
Sth Eth 250 Firmware
40
Exynos Modem 5300 Firmware
38
Exynos 9110 Firmware
37
X14J Firmware
36
Exynos Modem 5123 Firmware
36
Exynos 990 Firmware
36
Exynos W1000 Firmware
33
Exynos 1580 Firmware
33
Account
28
Galaxy Store
27
Internet
26
Escargot
25
Air Sdk
23
Air Desktop Runtime
23
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-86313 | Out-of-bounds write in Samsung's open-source Walrus WebAssembly runtime allows a crafted WASM component to corrupt process heap memory via a WASI 0.2 stream-read implementation flaw. The root cause is a `memcpy` in `WASI02Impl.cpp` that copies the requested read length (`size`) rather than the actual bytes read (`read`) from the buffer, writing beyond valid buffer bounds when a partial or short read occurs. A secondary defective bounds check for type-index validation in the WASM component parser compounds the attack surface. A proof-of-concept WASM file (`stream-read-oob-poc.wast`) was committed as part of the fix in PR #482, confirming exploitability; no public exploit independent of the fix has been identified at time of analysis. | HIGH | 7.8 | 0.1% | 39 |
No patch
|
| CVE-2026-23789 | The MFC (Multi Format Codec) encoder driver in Samsung Exynos mobile and wearable processors contains a double-free vulnerability triggered by improper cleanup of dma_buf references during error handling paths. The flaw spans seventeen Exynos SoC variants - Exynos 850 through 2600 mobile series and W920/W930/W1000 wearable chips - present in Samsung Galaxy smartphones and Galaxy Watch devices, and can lead to kernel heap corruption with potential local privilege escalation to arbitrary kernel-mode code execution. No active exploitation has been confirmed (not listed in CISA KEV) and no public proof-of-concept is identified in the available input data. | HIGH | 7.8 | 0.1% | 39 |
No patch
|
| CVE-2026-33963 | Stack-based buffer overflow in the camera driver of Samsung Exynos mobile processors (1330, 1380, 1480, 1580, 1680, 2400, 2500, 2600) allows a local low-privileged attacker to crash the camera subsystem or corrupt adjacent kernel memory by sending a malformed message to the driver. The vendor's CVSS vector (S:C, I:H, A:H) indicates that impact extends beyond a simple denial of service to potential kernel-level integrity corruption, though the advisory text describes only DoS - this discrepancy suggests the stack overflow may be exploitable beyond a crash. No public exploit code or active exploitation (KEV) has been identified at time of analysis. | HIGH | 7.5 | 0.1% | 38 |
No patch
|
| CVE-2026-21107 | Out-of-bounds write in Samsung Notes prior to version 4.4.45.5 allows a local low-privileged attacker to corrupt memory beyond allocated buffer boundaries, resulting in high confidentiality impact and minor integrity and availability effects. The CVSS 4.0 vector (AV:L/PR:L/UI:N/VC:H) confirms local access with low privileges is sufficient, with no user interaction required after the attacker establishes presence. No public exploit or active exploitation has been identified at time of analysis; Samsung Mobile released a patch in September 2026. | MEDIUM | 6.9 | 0.1% | 35 |
No patch
|
| CVE-2026-33964 | Untrusted pointer dereference in the camera driver of Samsung Exynos 1580 and 2500 mobile processors allows a local low-privileged attacker to cause denial of service or leak limited kernel information across security boundaries by sending a malformed message to the driver. The scope-changed CVSS vector (S:C) indicates impact extends beyond the immediate process context into privileged system components. No public exploit code and no CISA KEV listing have been identified at time of analysis. | MEDIUM | 6.4 | 0.1% | 32 |
No patch
|
| CVE-2026-85084 | Out-of-bounds write in Samsung TizenFX's MediaBufferBase component allows a local low-privileged attacker to corrupt memory by supplying unchecked array indices through the Tizen.Multimedia media buffer API. The vulnerable indexer property in `Tizen.Multimedia.Common.Internal.MediaBufferBase` lacked all bounds validation prior to fixes introduced in upstream PRs #7814 and #7815, admitting negative or oversized index values. Under high-complexity conditions, successful exploitation can produce high integrity and availability impact - crashing the multimedia subsystem or enabling controlled memory corruption - on Tizen-based devices such as Samsung Smart TVs and Galaxy Watch wearables. No public exploit exists and no active exploitation has been confirmed. | MEDIUM | 6.3 | 0.1% | 32 |
|
| CVE-2026-86314 | Integer overflow in Samsung Walrus WebAssembly runtime's Memory::init() source-bounds check allows an attacker who supplies a crafted WebAssembly module to trigger a 32-bit unsigned wrap-around that bypasses source-bounds validation, causing an out-of-bounds heap read and process crash (denial of service). The affected product is Samsung Walrus at commit ff3bf5ff5c4878f8e5572c9593d303f6bc997443 across all platforms. Publicly available exploit code exists in the form of a proof-of-concept .wast module (stream-read-oob-poc.wast) included in the upstream fix PR #482. | MEDIUM | 6.2 | 0.1% | 31 |
No patch
|
| CVE-2026-86315 | Out-of-bounds write in Samsung's Escargot JavaScript engine on Linux x86-64 allows process crash when a crafted class definition is supplied for execution. Numeric truncation (CWE-197) occurs when an instance initialization entry count exceeding UINT16_MAX is stored in a uint16_t field, producing a corrupted count that drives subsequent out-of-bounds memory writes and host process termination. Impact is limited to availability (denial of service); no confidentiality or integrity exploitation is indicated, and no public exploit or CISA KEV listing has been identified at time of analysis. | MEDIUM | 6.2 | 0.1% | 31 |
No patch
|
| CVE-2026-82797 | Uncontrolled recursion in Samsung's rlottie animation library crashes any application embedding it when processing a crafted Lottie animation file containing pathologically nested shape-group structures. The flaw resides in lottieparser.cpp's parseGroupObject() function, which processed nested shape groups recursively without any depth ceiling, enabling stack exhaustion via a malicious .lottie/.json file. No active exploitation is confirmed and no public exploit has been identified at time of analysis; this is a local, user-interaction-dependent denial-of-service vulnerability. | MEDIUM | 5.5 | 0.1% | 28 |
|
| CVE-2026-82926 | NULL pointer dereference in Samsung mTower's TEE kernel allows a Non-Secure caller to crash the secure world by supplying an invalid, zero, or stale session ID to the ioctl invoke path. The flaw exists in tee_ioctl_invoke() (entry_std.c) and tee_ta_invoke_command() (tee_ta_manager.c), where find_session() returns NULL without a guard before dereferencing sess->ctx, causing a secure-world fault. All mTower versions prior to commit afef59aa6f55c5d5ebf9b14bc020bf1c2c37489a are affected; no public exploit has been identified at time of analysis. | MEDIUM | 5.5 | 0.1% | 28 |
No patch
|
| CVE-2026-82927 | Untrusted pointer dereference in Samsung mTower's Secure world entry point allows a Non-Secure world caller to supply pointer values referencing Secure RAM, causing the TEE kernel to dereference those addresses on behalf of the attacker and potentially exposing or corrupting cryptographic material and other Secure world state. All mTower deployments before commit 06994e303637512e39062f3e037c222e8448e57e on ARM Cortex-M TrustZone hardware are affected, spanning both the session-open and invoke-command paths. No public exploit code has been identified and the vulnerability is absent from CISA KEV; however, the security boundary violated - Normal World to Secure World - represents a fundamental TrustZone integrity failure with real confidentiality and integrity consequences that the provided CVSS score significantly understates. | MEDIUM | 5.5 | 0.1% | 28 |
|
| CVE-2026-10420 | Pointer validation routines were systematically commented out across multiple TEE syscall handlers in Samsung's mTower open-source TEE implementation, leaving Trusted Application-supplied pointer arguments entirely unvalidated before dereference in the secure world. All mTower deployments on ARMv8-M hardware prior to commit 102d3dc75cf8e58e68e4bea54ae3c803992c91be are exposed to a denial-of-service condition whereby a malicious or buggy Trusted Application can crash the TEE by supplying address-space-wrapping pointer ranges to service calls in tee_svc.c and tee_svc_cryp.c. No public exploit has been identified at time of analysis and no CISA KEV listing exists. | MEDIUM | 5.5 | 0.1% | 28 |
|
| CVE-2026-21106 | Samsung Cloud Assistant prior to version 9.0.5 on Android exposes a broadcast receiver that fails to verify the origin of incoming intents, allowing any local application or process to send crafted messages that disable enhanced data protection settings. The attack requires on-device presence - either a co-resident malicious application or physical device access - but demands no special permissions, as reflected in the CVSS 4.0 PR:N metric. No active exploitation has been identified (not in CISA KEV) and no public proof-of-concept is known at time of analysis. | MEDIUM | 5.1 | 0.1% | 26 |
No patch
|
| CVE-2026-21112 | Improper input validation in Samsung Tips prior to Android 17 allows a local, low-privileged attacker to launch arbitrary Android activities under Samsung Tips' privileges. The attack requires user interaction to trigger the flaw, limiting its severity, but successful exploitation grants the attacker access to functionality and data scoped to the Samsung Tips application. No public exploit code or active exploitation has been identified at time of analysis. | MEDIUM | 5.1 | 0.1% | 26 |
No patch
|
| CVE-2026-49509 | Out-of-bounds read in Samsung's rlottie animation library (not Escargot as the CVE metadata incorrectly states) exposes consumers of the library - including Samsung TV appliances - to information disclosure and potential parser crashes when processing specially crafted JPEG images. The root cause is the absence of fractional-ratio validation in stb_image.h's JPEG frame header processor: when h_max is not evenly divisible by a color component's sampling factor, the resampler accesses memory beyond the intended buffer boundary. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV. | MEDIUM | 4.4 | 0.1% | 22 |
No patch
|