CVE-2026-23791

Awaiting Analysis Awaiting Analysis - Queue

Out-of-Bounds Write in Samsung Exynos DPU Driver

Publication date: 2026-09-14

Last updated on: 2026-09-22

Assigner: MITRE

Description

An issue was discovered in DPU in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, and 2600. An out-of-bounds write vulnerability in the Exynos DPU driver (due to missing input length validation in color mode LUT parsing) leads to kernel memory corruption and potential privilege escalation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-14

Last Modified

2026-09-22

Generated

2026-11-08

AI Q&A

2026-09-14

EPSS Evaluated

2026-11-07

NVD

CVE-2026-23791

EUVD

EUVD-2026-77155

Affected Vendors & Products

Vendor	Product	Version / Range
samsung	exynos_dpu	*
samsung	exynos_1280	*
samsung	exynos_2200	*
samsung	exynos_1380	*
samsung	exynos_1480	*
samsung	exynos_2400	*
samsung	exynos_1580	*
samsung	exynos_2500	*
samsung	exynos_1680	*
samsung	exynos_2600	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability is an out-of-bounds write issue in the Samsung Exynos DPU driver affecting multiple Exynos processors. It occurs due to missing input length validation during color mode LUT parsing, which can corrupt kernel memory and potentially allow privilege escalation.

Detection Guidance

Detection requires checking for affected Samsung Exynos DPU drivers on devices using the listed processors. Check kernel logs for DPU-related errors or memory corruption events. Use commands like 'dmesg | grep -i dpu' or 'lsmod | grep exynos_dpu' to inspect driver status. Verify kernel version and patch levels against Samsung's security updates.

Impact Analysis

An attacker could exploit this to corrupt kernel memory, leading to system instability or unauthorized privilege escalation. This may allow them to gain elevated access to the device, potentially compromising sensitive data or installing malicious software.

Compliance Impact

The vulnerability involves an out-of-bounds write in the Exynos DPU driver, which could lead to kernel memory corruption and privilege escalation. This type of vulnerability may compromise system integrity, potentially violating data protection requirements under standards like GDPR (data integrity and security) and HIPAA (integrity and availability of protected health information).

Mitigation Strategies

Apply the latest security patches from Samsung for affected Exynos processors. Check for updates via Samsung's official support page or device manufacturer. Disable unnecessary DPU features if patches are unavailable.

Hi! I’m here to help you understand CVE-2026-23791. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...