Samsung Semiconductor vulnerabilities and threats

CVE-2026-69043 is a use-after-free vulnerability in the Samsung Exynos 2200 GPU driver caused by improper synchronization during buffer object creation and closing, leading to memory corruption. A fix was released in October 2026.

CVE-2026-69044 is a use-after-free vulnerability in the Samsung GPU driver for the Exynos 1580 chipset. It arises from improper reference count handling during command submission, which can lead to memory corruption. A fix was released in October 2026.

CVE-2025-66366 is a vulnerability in the Samsung Semiconductor Exynos 1280 chipset where improper validation of array indices in handling unauthenticated downlink RRC Setup messages can cause the baseband to crash. This flaw was fixed in July 2026.

CVE-2026-33965 is a vulnerability in the Samsung Semiconductor Exynos 1080 chipset involving improper certificate validation (CWE-295). An attacker could exploit this by sending a malicious IMS message to the target device, potentially causing information exposure through the SIP message flow. A fix for this issue was released in October 2026.

CVE-2025-66367 is an out-of-bounds read vulnerability (CWE-125) in the Samsung Semiconductor Exynos 850 chipset. It arises from improper handling of NAS DLTransport messages, which may cause the baseband to crash. A fix was released in July 2026.

CVE-2025-66368 is a vulnerability in the Samsung Semiconductor Exynos 1080 chipset involving improper handling of SDP payloads, which can lead to a denial of service condition. The flaw is categorized under CWE-754, indicating an improper check for unusual or exceptional conditions. A fix was released in October 2026.

A vulnerability in Samsung Semiconductor's Exynos 1080 processor involves improper validation of a malformed RRC Reconfiguration message, causing an out-of-bounds access that leads to a denial-of-service condition. The issue is fixed as of October 2026.

CVE-2026-33971 is a vulnerability in the LTE RRC component of the Samsung Semiconductor Exynos 850 chipset. It involves improper handling of messages received before authentication, which triggers a data abort and results in a denial-of-service (DoS) condition. A fix for this issue was released in October 2026.

CVE-2026-33969 is a vulnerability in the Samsung Semiconductor Exynos 850 chipset where a missing lower bound check during the NAS Authentication Request message decoding causes an infinite loop. This flaw can lead to a Denial of Service condition. A fix was released in October 2026.

CVE-2026-33972 is a vulnerability in the Samsung Semiconductor Exynos 1080 modem's IMS stack where improper validation of specified quantity leads to an out-of-bounds access. This flaw can cause unexpected behavior or crashes in the affected component. A fix was released in October 2026.

CVE-2026-48179 is a vulnerability in the Samsung Semiconductor Exynos 1080 modem's IMS stack where improper validation of the SDP payload can cause a denial of service. The issue arises from incorrect handling of syntactic correctness in input data. A fix was released in September 2026.

CVE-2026-48176 is a memory corruption vulnerability in the Samsung Semiconductor Exynos 1080 caused by improper validation of specified quantity in input messages. This flaw can lead to memory corruption due to insufficient input validation. A fix was released in September 2026.

CVE-2026-35495 is an improper access control vulnerability in the IMS stack of Samsung Semiconductor's Exynos 1080 chipset. It arises from improper handling of SIP packets, leading to incorrect access control decisions. A fix was released in October 2026.

CVE-2025-66365 is a vulnerability in the Samsung Semiconductor Exynos 1080 chipset caused by improper handling of SIP packets, leading to baseband crashes. The issue is categorized under CWE-754, indicating an improper check for unusual or exceptional conditions. A fix for this vulnerability was released in October 2026.

CVE-2025-66364 is a vulnerability in the Samsung Semiconductor Exynos 850 chipset where continuously sending control-plane messages causes the baseband to crash. This is due to an improper check for unusual or exceptional conditions (CWE-754). A fix was released in October 2026.