215
CVEs
12
Critical
57
High
0
KEV
2
PoC
64
Unpatched C/H
10.7%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
12
HIGH
57
MEDIUM
131
LOW
11
Monthly CVE Trend
Affected Products (30)
Android
599
Exynos 1380 Firmware
107
Exynos 1280 Firmware
104
Exynos 980 Firmware
95
Exynos 1330 Firmware
85
Exynos 1080 Firmware
82
Exynos 850 Firmware
80
Exynos 1480 Firmware
77
Exynos 2200 Firmware
75
Exynos 2400 Firmware
66
Exynos W920 Firmware
60
Notes
57
Samsung Open Source
52
Exynos 2100 Firmware
52
Samsung Mobile
50
Exynos W930 Firmware
50
Sth Eth 250 Firmware
40
Exynos Modem 5300 Firmware
38
Exynos 9110 Firmware
37
X14J Firmware
36
Exynos Modem 5123 Firmware
36
Exynos 990 Firmware
36
Exynos W1000 Firmware
33
Exynos 1580 Firmware
33
Account
28
Galaxy Store
27
Internet
26
Escargot
25
Air Sdk
23
Air Desktop Runtime
23
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-54727 | Cross-container isolation bypass in proot-distro 5.1.5 and earlier (Termux) lets a crafted backup archive read and write files across otherwise isolated containers when a victim runs 'proot-distro restore'. Because the restore logic trusts the archive's hardlink 'linkname' to name the source container without verifying it matches the container being restored, an attacker who convinces a user to restore a malicious .tar can exfiltrate secrets (SSH keys, API credentials, databases) from one container into an attacker-controlled one, or inject attacker data into a different container. Publicly available exploit code exists (full PoCs are embedded in the GHSA advisory); no public active exploitation is known. | HIGH | 8.2 | 0.1% | 61 |
PoC
|
| CVE-2026-19587 | Uncontrolled resource consumption in Samsung's open-source rlottie library allows a crafted Lottie animation file to trigger excessive memory allocation, crashing any application that renders it. The root cause is unbounded amplification in the shape/repeater content tree: nested repeaters multiplied by point-heavy shapes (polystar, custom paths) can cause allocations that scale combinatorially with file complexity. All rlottie versions prior to the fix in GitHub PR #599 are affected; no patch release version is independently confirmed. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV. | MEDIUM | 6.5 | 20.0% | 52 |
No patch
|
| CVE-2026-19588 | Heap buffer overflow in Samsung's rlottie animation rendering library allows remote denial-of-service via maliciously crafted Lottie animation files. An integer overflow in the 32-bit bitmap stride calculation inside vbitmap.cpp produces an undersized heap allocation; when the library then writes full-dimension pixel data into this allocation, heap corruption and application crash result. No public exploit has been identified at time of analysis, but any application embedding rlottie that renders untrusted animation content is exposed given the network-deliverable, user-interaction attack path reflected in CVSS PR:N/UI:R. | MEDIUM | 6.5 | 20.0% | 52 |
No patch
|
| CVE-2025-54328 | Stack-based buffer overflow in Samsung Exynos chipset SMS message processing allows remote attackers to execute arbitrary code or crash devices via malformed SMS RP-DATA messages. Affects 22 Exynos processor and modem variants across mobile, wearable, and IoT devices, requiring no user interaction. CVSS 10.0 with network-level attack vector (PR:N), scope change, and full system impact. EPSS and exploitation status not provided, but SSVC framework indicates automatable attack with total technical impact. No public exploit identified at time of analysis, though the vulnerability class (CWE-121 stack buffer overflow in SMS parsing) has high weaponization potential. | CRITICAL | 10.0 | 0.1% | 50 |
No patch
|
| CVE-2026-25200 | Unauthenticated file upload leading to stored XSS and potential RCE in Samsung MagicInfo9 Server. HTML files uploaded without authentication. | CRITICAL | 9.8 | 0.0% | 49 |
No patch
|
| CVE-2026-25202 | Hardcoded database credentials in Samsung MagicInfo9 Server allow direct database access and manipulation. | CRITICAL | 9.8 | 0.0% | 49 |
No patch
|
| CVE-2025-52909 | Buffer overflow in Samsung Exynos Wi-Fi drivers (980, 850, 1280, 1330, 1380, 1480, 1580, W920, W930, W1000) allows unauthenticated remote attackers to execute arbitrary code with high integrity/confidentiality impact through malformed NL80211 vendor command ioctl messages. Improper input validation enables network-accessible exploitation without user interaction. CVSS 9.8 critical severity. No public exploit identified at time of analysis. | CRITICAL | 9.8 | 0.0% | 49 |
No patch
|
| CVE-2025-62818 | Out-of-bounds write in Samsung Exynos chipsets (processors 980/990/850/1080/2100/1280/2200/1330/1380/1480/2400/1580/2500/9110, wearables W920/W930/W1000, modems 5123/5300/5400) allows unauthenticated remote attackers to achieve arbitrary code execution via malformed SMS TP-UD packets. Exploitation occurs through TP-UDHI/UDL value mismatch during SMS message parsing, enabling network-level attacks without user interaction. No public exploit identified at time of analysis. | CRITICAL | 9.8 | 0.0% | 49 |
No patch
|
| CVE-2025-52908 | Buffer overflow in Samsung Exynos Wi-Fi driver (980, 850, 1280, 1330, 1380, 1480, 1580, W920, W930, W1000) allows unauthenticated remote code execution via malformed NL80211 vendor command ioctl message. Incorrect handling of vendor-specific wireless configuration commands enables network-based memory corruption. CVSS 9.8 critical severity reflects network attack vector requiring no authentication or user interaction. No public exploit identified at time of analysis. Low observed exploitation activity (EPSS 0.01%). | CRITICAL | 9.8 | 0.0% | 49 |
No patch
|
| CVE-2026-47310 | Use-after-free memory corruption in Samsung's Escargot JavaScript engine (commit 590345cc6258317c5da850d846ce6baaf2afc2d3) enables pointer manipulation when processing crafted JavaScript content, with CVSS 7.8 reflecting high-impact local exploitation requiring user interaction. The affected codepaths include evaluator error handling, TypedArray copyWithin operations on resizable buffers, DataView coercion, and array fast-mode transitions - all triggerable by attacker-controlled script. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV. | CRITICAL | 9.8 | 0.0% | 49 |
No patch
|
| CVE-2026-47311 | Heap-based buffer overflow in Samsung's Escargot JavaScript engine (commit 590345cc6258317c5da850d846ce6baaf2afc2d3) allows remote attackers to corrupt heap memory and likely achieve arbitrary code execution when a victim processes attacker-controlled JavaScript. No public exploit identified at time of analysis, but the upstream fix (PR #1565) reveals multiple memory-safety hardening changes including integer underflow protection in TypedArray.copyWithin, fast-mode array conversion checks during spread operations, and OOM handling, indicating concrete reachable corruption paths. CVSS 7.8 with local attack vector and required user interaction reflects the engine's typical embedding context (apps, IoT, smart TV runtimes) rather than network-facing services. | CRITICAL | 9.8 | 0.0% | 49 |
No patch
|
| CVE-2026-47314 | Out-of-bounds write in Samsung's Escargot lightweight JavaScript engine (commit 590345cc6258317c5da850d846ce6baaf2afc2d3) allows attackers to corrupt memory by inducing buffer overflows through crafted JavaScript. Exploitation requires local execution of attacker-supplied script content with user interaction, but successful triggering yields high impact to confidentiality, integrity, and availability (CVSS 7.8). No public exploit identified at time of analysis and the issue is not on the CISA KEV list. | CRITICAL | 9.8 | 0.0% | 49 |
No patch
|
| CVE-2025-27807 | Samsung Exynos processors (multiple models including 980, 990, 2100, 2200, 2400) and modems have an out-of-bounds write via malformed NAS (Non-Access Stratum) packets. This baseband vulnerability can be exploited over the cellular network without user interaction, potentially affecting millions of devices. | CRITICAL | 9.1 | 0.1% | 46 |
No patch
|
| CVE-2025-58349 | Baseband denial-of-service in Samsung Exynos chipsets (980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 2500, 9110, W920, W930, W1000, Modem 5123, 5300, 5400) allows remote attackers to crash mobile device basebands via malformed LTE MAC packets without authentication. The vulnerability affects the L2 layer processing of MAC Control Elements, enabling network-based attacks against cellular connectivity. EPSS score of 0.02% indicates low observed exploitation probability, and no public exploit identified at time of analysis, though the CVSS score of 9.1 reflects the severity of remotely disrupting critical cellular communications infrastructure. | CRITICAL | 9.1 | 0.0% | 46 |
No patch
|
| CVE-2026-25201 | Remote code execution in MagicInfo 9 Server (versions prior to 21.1090.1) allows unauthenticated attackers to upload arbitrary files without authentication, resulting in complete system compromise with high confidentiality, integrity, and availability impact. The vulnerability enables privilege escalation and requires only user interaction to trigger. No patch is currently available for this critical flaw affecting all vulnerable MagicInfo 9 Server installations. | HIGH | 8.8 | 0.0% | 44 |
No patch
|