Samsung Semiconductor has 35 CVEs on record. Disclosure cadence is accelerating: 35 in the last 90 days against 0 in the 90 before. The busiest recent month was November 2026 with 35. The median CVSS is 5.5 (medium). None have a confirmed exploitation report. The dominant weakness classes are CWE-754 (7) and CWE-787 (5). Most affected products: Exynos 1080 (8), Exynos 1480 (8), Exynos 1280 (6).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.5
- Publish → KEV
- —
- Last 90 days
- 35 prev 0
Weakness classes
Products
- Exynos 1080 8
- Exynos 1480 8
- Exynos 1280 6
- Exynos 850 6
- Exynos 2200 3
- Exynos 1580 2
Worst active — by depth score
CVE-2026-48175Medium· 5.5Processing a malformed RRC message leads to an out-of-bounds read, resulting in a denial-of-service condition.30CVE-2026-69068NoneInsufficient length validation in the GNSS firmware loader may lead to corruption of kernel memory.3CVE-2026-69066NoneMemory corruption in GPU driver due to improper validation of VMID reservation.3CVE-2026-69050NoneOut-of-bounds memory access in a device driver due to improper resource state tracking.3CVE-2026-69044NoneIn the Samsung GPU driver, improper reference count handling during command submission can lead to memory corruption.3
Samsung Semiconductor vulnerabilities
CVEs affecting Samsung Semiconductor, newest first. Open any entry for full detail, references, and exploit status.
35 CVEsRSS
CVE-2026-48175Medium· 5.5Processing a malformed RRC message leads to an out-of-bounds read, resulting in a denial-of-service condition.
Processing a malformed RRC message leads to an out-of-bounds read, resulting in a denial-of-service condition.
CVE-2026-48173NoneIn the NAS message handler, improper validation of the length field in NAS message causes memory corruption
In the NAS message handler, improper validation of the length field in NAS message causes memory corruption
CVE-2026-35494NoneIn the baseband, memory corruption during NAS packet processing can cause a denial of service.
In the baseband, memory corruption during NAS packet processing can cause a denial of service.
CVE-2026-68993NoneA double free vulnerability in NPU driver due to improper pointer management (940)
A double free vulnerability in NPU driver due to improper pointer management (940)
CVE-2026-48178NoneOut of bound access in PPC due to race condition in global variable access
Out of bound access in PPC due to race condition in global variable access
CVE-2026-48174NoneIn the NR RRC component, improper handling of messages before authentication triggers a data abort, which leads to a denial‑of‑service condition.
In the NR RRC component, improper handling of messages before authentication triggers a data abort, which leads to a denial‑of‑service condition.
CVE-2026-68994NoneA double free vulnerability in NPU driver due to improper pointer management (941)
A double free vulnerability in NPU driver due to improper pointer management (941)
CVE-2026-48186NoneImproper handling of messages before AS security activation can cause unexpected behavior
Improper handling of messages before AS security activation can cause unexpected behavior
CVE-2026-68985NoneIn the Samsung Exynos NPU driver, improper validation of user input in the ioctl handler can lead to an out-of-bounds write, which causes a denial of service.
In the Samsung Exynos NPU driver, improper validation of user input in the ioctl handler can lead to an out-of-bounds write, which causes a denial of service.
CVE-2026-48183NoneImproper permission handling during buffer operations allows untrusted applications to create memory mappings with inappropriate permissions
Improper permission handling during buffer operations allows untrusted applications to create memory mappings with inappropriate permissions
CVE-2026-69005NoneInteger overflow in NPU driver parameter processing due to insufficient bounds checking.
Integer overflow in NPU driver parameter processing due to insufficient bounds checking.
CVE-2026-68984NoneIn the Samsung Exynos NPU kernel driver, an integer overflow allows an unprivileged application to trigger memory corruption.
In the Samsung Exynos NPU kernel driver, an integer overflow allows an unprivileged application to trigger memory corruption.
CVE-2026-69068NoneInsufficient length validation in the GNSS firmware loader may lead to corruption of kernel memory.
Insufficient length validation in the GNSS firmware loader may lead to corruption of kernel memory.
CVE-2026-69006NoneInsufficient validation of length fields in the GNSS firmware loader can result in kernel‑memory corruption.
Insufficient validation of length fields in the GNSS firmware loader can result in kernel‑memory corruption.
CVE-2026-69025NoneIn the Exynos NPU driver, improper validation of user input in the ioctl handler can lead to an out-of-bounds write, which causes a denial of service
In the Exynos NPU driver, improper validation of user input in the ioctl handler can lead to an out-of-bounds write, which causes a denial of service
CVE-2026-68990NoneIn the Samsung Exynos H-Arx DRM plugin, improper input validation during buffer operations can cause memory corruption, potentially leading to denial of service or privilege escalation.
In the Samsung Exynos H-Arx DRM plugin, improper input validation during buffer operations can cause memory corruption, potentially leading to denial of service or privilege escalation.
CVE-2026-69066NoneMemory corruption in GPU driver due to improper validation of VMID reservation.
Memory corruption in GPU driver due to improper validation of VMID reservation.
CVE-2026-69002NoneIncorrect authorization in Samsung framework services due to missing permission checks
Incorrect authorization in Samsung framework services due to missing permission checks
CVE-2026-68991NoneIn the Samsung Exynos ENN NeuralNetworks HAL, improper input validation during request processing can cause memory corruption and lead to a denial of service condition.
In the Samsung Exynos ENN NeuralNetworks HAL, improper input validation during request processing can cause memory corruption and lead to a denial of service condition.
CVE-2026-69050NoneOut-of-bounds memory access in a device driver due to improper resource state tracking.
Out-of-bounds memory access in a device driver due to improper resource state tracking.
CVE-2026-69043NoneIn the Samsung Exynos GPU driver, improper synchronization during buffer object creation and closing can lead to memory corruption
In the Samsung Exynos GPU driver, improper synchronization during buffer object creation and closing can lead to memory corruption
CVE-2026-69044NoneIn the Samsung GPU driver, improper reference count handling during command submission can lead to memory corruption.
In the Samsung GPU driver, improper reference count handling during command submission can lead to memory corruption.
CVE-2026-33965NoneAn attacker may send a malicious IMS message to the target device, potentially leading to information exposure through the SIP message flow.
An attacker may send a malicious IMS message to the target device, potentially leading to information exposure through the SIP message flow.
CVE-2025-66366NoneIncorrect handling of unauthenticated downlink RRC Setup messages can cause the baseband to crash
Incorrect handling of unauthenticated downlink RRC Setup messages can cause the baseband to crash
CVE-2025-66367NoneImproper handling of NAS DLTransport messages may lead to a baseband crash.
Improper handling of NAS DLTransport messages may lead to a baseband crash.
CVE-2025-66368NoneIncorrect handling of SDP payload leads to a Denial of Service
Incorrect handling of SDP payload leads to a Denial of Service
CVE-2026-33971NoneIn the LTE RRC component, improper handling of messages before authentication triggers a data abort, which leads to a denial‑of‑service condition.
In the LTE RRC component, improper handling of messages before authentication triggers a data abort, which leads to a denial‑of‑service condition.
CVE-2026-33969NoneIn the NAS Authentication Request message decoding procedure, a missing lower bound check causes an infinite loop, leading to Denial of Service.
In the NAS Authentication Request message decoding procedure, a missing lower bound check causes an infinite loop, leading to Denial of Service.
CVE-2026-33958NoneProcessing a malformed RRC Reconfiguration message leads to an out-of-bounds (OOB) access, resulting in a denial-of-service (DoS) condition.
Processing a malformed RRC Reconfiguration message leads to an out-of-bounds (OOB) access, resulting in a denial-of-service (DoS) condition.
CVE-2026-48179NoneIn the Exynos modem's IMS stack, improper handling of SDP payload leads to a Denial of Service
In the Exynos modem's IMS stack, improper handling of SDP payload leads to a Denial of Service