What is CVE-2026-33970?

CVE-2026-33970 is a low-severity vulnerability in Samsung Exynos 850 Firmware, classified under NULL Pointer Dereference. CVSS score: 3.5/10. Published 2026-09-14.

How severe is CVE-2026-33970?

Low severity. CVSS v3 base score is 3.5 out of 10.

NULL pointer dereference in Samsung Exynos 850 Firmware

CVE-2026-33970

An issue was discovered in NR RRC and L2 in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 2500, 1680, W920, W930, W1000, and Modem 5410. In the 5G baseband, a NULL Pointer Dereference occurs when processing a malformed RRC Reconfiguration message.

EPSS: 0.002 (9.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 3.5 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L.

Affected products

Samsung Exynos 850 Firmware

Weakness classification (CWE)

CWE-476 — NULL Pointer Dereference

References

cve@mitre.org
cve@mitre.org

Frequently asked questions

What is CVE-2026-33970?: CVE-2026-33970 is a low-severity vulnerability in Samsung Exynos 850 Firmware, classified under NULL Pointer Dereference. CVSS score: 3.5/10. Published 2026-09-14.
How severe is CVE-2026-33970?: Low severity. CVSS v3 base score is 3.5 out of 10.