What is CVE-2026-23789?

CVE-2026-23789 is a high-severity vulnerability in Samsung Exynos 850 Firmware, classified under Double Free. CVSS score: 7.8/10. Published 2026-09-14.

How severe is CVE-2026-23789?

High severity. CVSS v3 base score is 7.8 out of 10.

Double Free in Samsung Exynos 850 Firmware

CVE-2026-23789

An issue was discovered in MFC in Samsung Mobile Processor and Wearable Processor Exynos 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 2500, 2600, 1680, W920, W930, and W1000. A double-free vulnerability in the Exynos MFC encoder driver (due to improper cleanup of dma_buf references during error handling) leads to kernel memory corruption and potential arbitrary code execution.

Vulnerability class: Double Free

EPSS: 0.001 (1.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H.

Affected products

Samsung Exynos 850 Firmware

Weakness classification (CWE)

CWE-415 — Double Free

References

Frequently asked questions

What is CVE-2026-23789?: CVE-2026-23789 is a high-severity vulnerability in Samsung Exynos 850 Firmware, classified under Double Free. CVSS score: 7.8/10. Published 2026-09-14.
How severe is CVE-2026-23789?: High severity. CVSS v3 base score is 7.8 out of 10.