Threat database

CVE-2026-68994 is a double free vulnerability in the NPU driver of Samsung Semiconductor's Exynos 1480 chipset caused by improper pointer management. This flaw can lead to memory corruption issues. A fix for this vulnerability is available as of November 2026.

CVE-2026-48183 is a vulnerability in the Samsung Semiconductor Exynos 1480 chipset involving improper permission handling during buffer operations. This flaw allows untrusted applications to create memory mappings with inappropriate permissions, potentially leading to unauthorized access or privilege escalation. A fix for this issue was released in October 2026.

An integer overflow vulnerability in the Samsung Exynos NPU kernel driver for the Exynos 2100 chipset allows an unprivileged application to cause memory corruption. This flaw is identified as CWE-190 and affects version 0 of the product. A fix was released in November 2026.

CVE-2026-69005 is an integer overflow vulnerability in the NPU driver parameter processing of the Samsung Semiconductor Exynos 1480 chipset. The flaw arises from insufficient bounds checking, which can lead to integer overflow or wraparound conditions. A fix for this vulnerability was released in November 2026.

CVE-2026-68985 is an out-of-bounds write vulnerability in the Samsung Exynos 1280 NPU driver caused by improper validation of user input in the ioctl handler. This flaw can lead to a denial of service condition. A fix for this vulnerability was released in November 2026.

CVE-2026-69006 is a vulnerability in the Samsung Semiconductor Exynos 850 where insufficient validation of length fields in the GNSS firmware loader can lead to kernel-memory corruption. This flaw was identified and fixed in November 2026.

CVE-2026-69068 is an out-of-bounds write vulnerability in the GNSS firmware loader of the Samsung Semiconductor Exynos Modem 5300. It is caused by insufficient length validation, which may lead to corruption of kernel memory. A fix is available as of November 2026.

CVE-2026-69025 is a vulnerability in the Samsung Semiconductor Exynos 1480 NPU driver where improper validation of user input in the ioctl handler can cause an out-of-bounds write, leading to a denial of service condition. This issue is identified as a NULL Pointer Dereference (CWE-476). A fix is available as of November 2026.

CVE-2026-68990 is a vulnerability in the Samsung Exynos H-Arx DRM plugin involving improper input validation during buffer operations. This flaw can cause memory corruption, which may lead to denial of service or privilege escalation. A fix for this issue is available as of November 2026.

CVE-2026-68991 is an out-of-bounds write vulnerability in the Samsung Exynos ENN NeuralNetworks HAL component of the Exynos 1480 chipset. Improper input validation during request processing can cause memory corruption, potentially leading to a denial of service condition. A fix for this vulnerability is available as of November 2026.

CVE-2026-69002 is a vulnerability in Samsung Semiconductor's Exynos 1580 chipset involving missing authorization checks in framework services. This flaw allows unauthorized access due to improper permission validation. The issue was identified and fixed in November 2026.

CVE-2026-69066 is a vulnerability in the Samsung Semiconductor Exynos 2200 GPU driver caused by improper validation of VMID reservation, leading to memory corruption. The issue is classified under CWE-754, which involves improper checks for unusual or exceptional conditions. A fix is available as of November 2026.

CVE-2026-69050 is an out-of-bounds memory access vulnerability in the Samsung Semiconductor Exynos 1480 device driver caused by improper resource state tracking. This flaw could potentially lead to memory corruption. A fix was released in November 2026.

CVE-2026-69043 is a use-after-free vulnerability in the Samsung Exynos 2200 GPU driver caused by improper synchronization during buffer object creation and closing, leading to memory corruption. A fix was released in October 2026.

CVE-2026-69044 is a use-after-free vulnerability in the Samsung GPU driver for the Exynos 1580 chipset. It arises from improper reference count handling during command submission, which can lead to memory corruption. A fix was released in October 2026.

CVE-2025-66366 is a vulnerability in the Samsung Semiconductor Exynos 1280 chipset where improper validation of array indices in handling unauthenticated downlink RRC Setup messages can cause the baseband to crash. This flaw was fixed in July 2026.

CVE-2026-33965 is a vulnerability in the Samsung Semiconductor Exynos 1080 chipset involving improper certificate validation (CWE-295). An attacker could exploit this by sending a malicious IMS message to the target device, potentially causing information exposure through the SIP message flow. A fix for this issue was released in October 2026.

CVE-2025-66367 is an out-of-bounds read vulnerability (CWE-125) in the Samsung Semiconductor Exynos 850 chipset. It arises from improper handling of NAS DLTransport messages, which may cause the baseband to crash. A fix was released in July 2026.

CVE-2025-66368 is a vulnerability in the Samsung Semiconductor Exynos 1080 chipset involving improper handling of SDP payloads, which can lead to a denial of service condition. The flaw is categorized under CWE-754, indicating an improper check for unusual or exceptional conditions. A fix was released in October 2026.

A vulnerability in Samsung Semiconductor's Exynos 1080 processor involves improper validation of a malformed RRC Reconfiguration message, causing an out-of-bounds access that leads to a denial-of-service condition. The issue is fixed as of October 2026.