Threat database

An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500, 2600, and 1680. In the camera driver, a Time-of-Check Time-of-Use (TOCTOU) race condition leads to out-of-bounds access.

An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500, 2600, and 1680. In the camera driver, an out-of-bounds array access vulnerability in the error-handling path leads to memory corruption.

An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500, 2600, and 1680. An information Leak occurs in the camera driver due to Insertion of Sensitive Information Into Debugging Code.

An issue was discovered in CustOS Driver in Samsung Mobile Processor Exynos 1580. Requesting oversized shared memory from the custos_iwc device enables out-of-bounds read and write, potentially leading to memory corruption or information leakage.

An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380, 1480, 2400, 1580, and 2500. Sending a malformed message to the test_msg sysfs entry causes an out-of-bounds write, leading to denial of service.

An issue was discovered in Samsung Mobile Processor Exynos 1330, 1380, 1480, and 2400. An out-of-bounds memory access vulnerability in the camera GDC driver may lead to kernel memory corruption under certain conditions.

An issue was discovered in NR RRC in Samsung Mobile Processor and Modem Exynos 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 2500, W1000, Modem 5300, Modem 5400, and Modem 5410. Incorrect handling of unauthenticated downlink RRC Setup messages can cause the baseband to crash.

An issue was discovered in DPU in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, and 2600. An out-of-bounds write vulnerability in the Exynos DPU driver (due to missing input length validation in color mode LUT parsing) leads to kernel memory corruption and potential privilege escalation.

An issue was discovered in DPU in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, and 2600. A double-free vulnerability in the Samsung Exynos DPU driver (due to improper pointer management during DMA buffer reallocation) leads to kernel memory corruption and a potential use-after-free.

An issue was discovered in MFC in Samsung Mobile Processor and Wearable Processor Exynos 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 2500, 2600, 1680, W920, W930, and W1000. A double-free vulnerability in the Exynos MFC encoder driver (due to improper cleanup of dma_buf references during error handling) leads to kernel memory corruption and potential arbitrary code execution.

An issue was discovered in DPU in Samsung Mobile Processor Exynos 1280, 2200, and 1380. A heap overflow in the Exynos DRM HDR driver (due to improper buffer size validation) leads to kernel memory corruption and a system crash.

An issue was discovered in DPU in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, and 2600. A Use-After-Free in the Exynos DRM HDR driver (due to improper cleanup upon vmap failure) leads to a kernel crash.

An issue was discovered in DPU in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, and 2600. A TOCTOU race condition in the Exynos DRM HDR Driver leads to a heap overflow, causing a kernel crash.

CVE-2024-53922 is a medium severity vulnerability in the buffer queue driver of Samsung Automotive Processor Exynos Auto 8890 firmware versions 7, 9, and 920. The flaw is due to improper validation of the specified quantity in input, specifically a lack of length check, which can cause a denial of service (DoS) in the kernel.

CVE-2026-21104 is a heap-based buffer overflow vulnerability in the KnoxVault trustlet component of Samsung Mobile Devices prior to the SMR Sep-2026 Release 1. It allows local privileged attackers to execute arbitrary code. The vulnerability has a high severity score of 7.1 according to CVSS 4.0. No specific affected versions or patch information is provided.

CVE-2026-21103 is a path traversal vulnerability in Samsung Mobile's GalaxyDiagnostics component prior to the SMR Sep-2026 Release 1. This flaw allows physical attackers to access files with system privileges on affected Samsung Mobile devices. The vulnerability has a CVSS 4.0 base score of 6.8, indicating medium severity. No specific affected versions or patch information is provided in the available data.

CVE-2026-21102 is a critical use-after-free vulnerability in the DualDAR component of Samsung Mobile Devices prior to the SMR September 2026 Release 1. It allows local privileged attackers to execute arbitrary code with root privileges. The vulnerability has a high CVSS 4.0 score of 9.3, indicating severe impact. No specific affected versions or patch information is provided in the available data.

CVE-2026-21101 is a high-severity vulnerability in Samsung Mobile Devices involving improper input validation in the DualDAR driver before the SMR Sep-2026 Release 1. It allows local privileged attackers to potentially execute arbitrary code with root privileges. The vulnerability requires local access and high privileges to exploit and does not involve user interaction. No patch or vendor advisory details are provided regarding remediation.

CVE-2026-21100 is an improper access control vulnerability in the SystemUI component of Samsung Mobile Devices prior to the SMR Sep-2026 Release 1. This flaw allows local attackers to launch arbitrary activities on affected devices. The vulnerability has a medium severity with a CVSS 4.0 base score of 6.9. No specific affected versions or patch information is provided in the available data.

CVE-2026-21099 is a medium severity vulnerability in Samsung Mobile Devices involving improper access control in the SettingsProvider component prior to the SMR Sep-2026 Release 1. This flaw allows local attackers to access sensitive information due to insufficient permission handling.