Samsung Exynos: 19 Vulnerabilities Disclosed Together Across Multiple Processors
Samsung Exynos processors impacted by a batch of 19 disclosed vulnerabilities, ranging from Low to High severity, affecting mobile, wearable, and automotive components.
Key findings
- 19 vulnerabilities disclosed in Samsung Exynos processors between Sept 14-15, 2026, affecting mobile, wearable, and automotive components.
- Vulnerabilities span multiple components including camera, DPU, MFC, Wi-Fi, and open-source libraries, with severities ranging from Low to High.
- Key high-severity flaws include double-free and buffer overflow vulnerabilities in MFC and DPU drivers, potentially leading to memory corruption and privilege escalation.
- Multiple camera driver vulnerabilities, including buffer overflows and information leaks, affect a wide range of Exynos processors.
- The batch includes memory corruption issues like stack/heap overflows, out-of-bounds access, and NULL pointer dereferences.
On September 14 and 15, 2026, a significant batch of 19 vulnerabilities was disclosed across various Samsung Exynos processors, impacting mobile, wearable, automotive, and modem components. These vulnerabilities, ranging in severity from Low to High, were reported together, highlighting potential systemic issues in Samsung's embedded software. The disclosures span multiple components, including camera, DPU, MFC, Wi-Fi, and open-source libraries like Escargot and rLottie.
Several vulnerabilities center on memory corruption, including stack-based buffer overflows, heap overflows, and out-of-bounds access. For instance, CVE-2026-91826, a stack-based buffer overflow in rLottie, could allow attackers to execute arbitrary code in the context of the current process when rendering crafted animations. Similarly, CVE-2026-33963 describes a stack-based buffer overflow in the camera driver, potentially leading to denial of service.
A notable cluster of vulnerabilities affects the camera driver (CVE-2026-33963, CVE-2026-33962, CVE-2026-33956, CVE-2026-33968, CVE-2026-33967, CVE-2026-33966). These include buffer overflows, out-of-bounds access, TOCTOU race conditions, and information leaks, primarily impacting Exynos 1330, 1380, 1480, 2400, 1580, 2500, 2600, and 1680 processors.
The Display Processing Unit (DPU) is also a target, with several medium-severity vulnerabilities disclosed. CVE-2026-23791, CVE-2026-23790, and CVE-2026-23788, affecting various Exynos processors, involve out-of-bounds writes, double-free vulnerabilities, and heap overflows, potentially leading to kernel memory corruption and privilege escalation. CVE-2026-23786, also in the DPU, presents a TOCTOU race condition leading to a heap overflow.
High-severity flaws include CVE-2026-23789, a double-free vulnerability in the Exynos MFC encoder driver, and CVE-2026-92259, an integer overflow in Samsung Opensource Escargot that could lead to a heap-based buffer overflow and denial of service.
Other vulnerabilities include a NULL Pointer Dereference in the 5G baseband (CVE-2026-33970), an out-of-bounds read/write in the CustOS Driver (CVE-2026-33957), and improper buffer allocation in the Wi-Fi interface (CVE-2026-33960).
The batch of disclosures spans a wide range of Exynos processors, from older models like Exynos 9810 to newer ones like Exynos 2600 and 2500, as well as wearable and automotive variants. The coordinated disclosure of these vulnerabilities underscores the importance of timely patching and security updates for Samsung device users.
While specific patch details were not provided in the initial disclosures, users are advised to ensure their Samsung devices are running the latest available software updates, as these vulnerabilities are addressed through security patches released by Samsung.
The sheer volume and variety of affected components and processor families indicate a broad security posture that requires ongoing vigilance from both Samsung and its users. The disclosed vulnerabilities, particularly those with higher severity ratings, could have significant implications for device security if left unpatched.
The disclosure window for this batch of vulnerabilities was from September 14, 2026, to September 15, 2026. The Zero Day Initiative reported on CVE-2026-91826, detailing its potential for remote code execution. Vypr Intelligence highlighted nine processor vulnerabilities disclosed on September 14, 2026, including several DPU and MFC flaws.
Users of Samsung devices with affected Exynos processors should prioritize applying any available security updates to mitigate the risks associated with these vulnerabilities. Continuous monitoring of Samsung's official security advisories is recommended for the latest information on patches and affected devices.
The range of affected Exynos processors, from mobile to automotive and wearable, emphasizes the pervasive nature of these security flaws. The vulnerabilities touch upon critical components like the camera, DPU, and MFC, which are integral to device functionality and security.
This coordinated disclosure event serves as a reminder of the complex security landscape surrounding modern mobile processors and the continuous effort required to maintain a secure ecosystem. Users are encouraged to stay informed and proactive in managing their device security.
The vulnerabilities disclosed include: CVE-2026-92259, CVE-2026-91826, CVE-2023-37366, CVE-2026-33970, CVE-2026-33968, CVE-2026-33967, CVE-2026-33966, CVE-2026-33963, CVE-2026-33962, CVE-2026-33960, CVE-2026-33957, CVE-2026-33956, CVE-2026-23792, CVE-2026-23791, CVE-2026-23790, CVE-2026-23789, CVE-2026-23788, CVE-2026-23787, CVE-2026-23786.