Samsung
1707 CVEs across 2902 Samsung products. Browse Samsung vulnerabilities, severities, and proof-of-concept exploits.
Samsung products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-37366 | Low | 2.8 | 2026-09-14 | An issue was discovered in Samsung Exynos Mobile Processor, Automotive Processor, and Modem Exynos 9810, Exynos 9610, Exynos 9820, Exynos 980, Exynos 850, Exyn… |
CVE-2026-33970 | Low | 3.5 | 2026-09-14 | An issue was discovered in NR RRC and L2 in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400… |
CVE-2026-33968 | Low | 2.8 | 2026-09-14 | An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500, 2600, and 1680. In the camera driver, a Time-of-Check… |
CVE-2026-33967 | Low | 2.8 | 2026-09-14 | An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500, 2600, and 1680. In the camera driver, an out-of-bounds… |
CVE-2026-33966 | Low | 2.8 | 2026-09-14 | An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500, 2600, and 1680. An information Leak occurs in the came… |
CVE-2026-33964 | Medium | 6.4 | 2026-09-14 | An issue was discovered in camera in Samsung Mobile Processor Exynos 1580 and 2500. An untrusted pointer dereference occurs when a malformed message is sent to… |
CVE-2026-33963 | High | 7.5 | 2026-09-14 | An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500, 2600, and 1680. A stack-based buffer overflow occurs w… |
CVE-2026-33962 | Low | 2.8 | 2026-09-14 | An issue was discovered in Wi-Fi in Samsung Mobile Processor Exynos 850, 1280, 1330, 1380, 1480, 2400, W920, and W930. A malformed Netlink command can trigger… |
CVE-2026-33960 | Low | 2.8 | 2026-09-14 | An issue was discovered in Samsung Mobile Processor and Wearable Processor Exynos 1330, 1380, 1480, 1580, 1680, W920, W930, and W1000. . A malformed ioctl comm… |
CVE-2026-33957 | Medium | 4.2 | 2026-09-14 | An issue was discovered in CustOS Driver in Samsung Mobile Processor Exynos 1580. Requesting oversized shared memory from the custos_iwc device enables out-of-… |
CVE-2026-23793 | Low | 3.5 | 2026-09-14 | An issue was discovered in Samsung Mobile Processor Exynos 1330, 1380, 1480, and 2400. An out-of-bounds memory access vulnerability in the camera GDC driver ma… |
CVE-2026-23792 | Medium | 4.0 | 2026-09-14 | An issue was discovered in NR RRC in Samsung Mobile Processor and Modem Exynos 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 2500, W1000, Modem 5300, M… |
CVE-2026-23791 | Medium | 4.2 | 2026-09-14 | An issue was discovered in DPU in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, and 2600. An out-of-bounds write vulnerabilit… |
CVE-2026-23790 | Medium | 4.2 | 2026-09-14 | An issue was discovered in DPU in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, and 2600. A double-free vulnerability in the… |
CVE-2026-23789 | High | 7.8 | 2026-09-14 | An issue was discovered in MFC in Samsung Mobile Processor and Wearable Processor Exynos 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 2500, 2600… |
CVE-2026-23788 | Medium | 4.2 | 2026-09-14 | An issue was discovered in DPU in Samsung Mobile Processor Exynos 1280, 2200, and 1380. A heap overflow in the Exynos DRM HDR driver (due to improper buffer si… |
CVE-2026-23787 | Medium | 4.2 | 2026-09-14 | An issue was discovered in DPU in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, and 2600. A Use-After-Free in the Exynos DRM… |
CVE-2026-23786 | Low | 2.8 | 2026-09-14 | An issue was discovered in DPU in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, and 2600. A TOCTOU race condition in the Exyn… |
CVE-2024-53922 | Medium | 5.7 | 2026-09-14 | An issue was discovered in the buffer queue driver in Samsung Automotive Processor Exynos Auto 8890, V7, V9, and V920. Lack of a length check leads to a Denial… |
CVE-2026-21113 | Medium | 5.5 | 2026-09-09 | Improper export of android application components in Visual Voicemail prior to version 20.1.00.05 allows local attackers to initiate call without proper permis… |
CVE-2026-21112 | Medium | 5.5 | 2026-09-09 | Improper input validation in Samsung Tips prior to Android 17 allows local attackers to launch arbitrary activity with Samsung Tips privilege. User interaction… |
CVE-2026-21108 | Medium | 5.5 | 2026-09-09 | Improper export of android application components in Bixby Touch prior to version 4.3.01.17 allows local attackers to access sensitive information. |
CVE-2026-21107 | Medium | 5.5 | 2026-09-09 | Out-of-bounds write in Samsung Notes prior to version 4.4.45.5 allows local attackers to write out-of-bounds memory. |
CVE-2026-21105 | Medium | 5.5 | 2026-09-09 | Improper access control in Collection prior to version 1.0.1.14 in Android 15 and 2.0.02.7 in Android 16 allows local attackers to access sensitive information. |
CVE-2026-21104 | Medium | 6.7 | 2026-09-09 | Heap-based buffer overflow in KnoxVault trustlet prior to SMR Sep-2026 Release 1 allows local privileged attackers to execute arbitrary code. |
CVE-2026-21103 | Medium | 6.1 | 2026-09-09 | Path traversal in GalaxyDiagnostics prior to SMR Sep-2026 Release 1 allows physical attackers to access files with system privilege. |
CVE-2026-21102 | Medium | 6.7 | 2026-09-09 | Use after free in DualDAR prior to SMR Sep-2026 Release 1 allows local privileged attackers to execute arbitrary code with root privilege. |
CVE-2026-21101 | Medium | 6.7 | 2026-09-09 | Improper input validation in DualDAR driver prior to SMR Sep-2026 Release 1 allows local privileged attackers to potentially execute arbitrary code with root p… |
CVE-2026-21100 | High | 7.1 | 2026-09-09 | Improper access control in SystemUI prior to SMR Sep-2026 Release 1 allows local attackers to launch arbitrary activity. |
CVE-2026-21099 | Medium | 5.5 | 2026-09-09 | Improper access control in SettingsProvider prior to SMR Sep-2026 Release 1 allows local attackers to access sensitive information. |
CVE-2026-21098 | Medium | 6.1 | 2026-09-09 | Improper access control in Link to Windows prior to SMR Sep-2026 Release 1 allows local attackers to establish a connection with the PC without proper user int… |
CVE-2026-21097 | Medium | 6.7 | 2026-09-09 | Improper authentication in ActivityTaskManagerService prior to SMR Sep-2026 Release 1 allows local privileged attackers to launch arbitrary activity. |
CVE-2026-21096 | Critical | 9.8 | 2026-09-09 | Heap-based buffer overflow in JPEG decoder of libimagecodec.quram.so prior to SMR Sep-2026 Release 1 allows remote attackers to execute arbitrary code. |
CVE-2026-21095 | Critical | 9.8 | 2026-09-09 | Heap-based buffer overflow in DNG decoder of libimagecodec.quram.so prior to SMR Sep-2026 Release 1 allows remote attackers to execute arbitrary code. |
CVE-2026-21094 | High | 8.8 | 2026-09-09 | Improper input validation in wpa_supplicant prior to SMR Sep-2026 Release 1 allows adjacent attackers to write out-of-bounds memory. |
CVE-2026-21093 | Medium | 6.7 | 2026-09-09 | Stack-based buffer overflow in PROCA trustlet prior to SMR Sep-2026 Release 1 allows local privileged attackers to write out-of-bounds memory. |
CVE-2026-21092 | Medium | 5.3 | 2026-09-09 | Path traversal in ImsService prior to SMR Sep-2026 Release 1 allows remote attackers to create image files with system server privilege. |
CVE-2026-21091 | High | 7.8 | 2026-09-09 | Out-of-bounds write in libcodec2secevrcdec.so prior to SMR Sep-2026 Release 1 allows local attackers to write out-of-bounds memory. |
CVE-2026-21090 | High | 7.8 | 2026-09-09 | Out-of-bounds write in libsaviextractor.so prior to SMR Sep-2026 Release 1 allows local attackers to write out-of-bounds memory. |
CVE-2026-21089 | High | 7.8 | 2026-09-09 | Improper input validation in removing style tag in libsubextractor.so prior to SMR Sep-2026 Release 1 allows local attackers to write out-of-bounds memory. |
CVE-2026-21088 | High | 7.8 | 2026-09-09 | Improper input validation in loading a subtitle frame in libsubextractor.so prior to SMR Sep-2026 Release 1 allows local attackers to write out-of-bounds memor… |
CVE-2026-21087 | High | 7.8 | 2026-09-09 | Out-of-bounds write in libmdnie.so prior to SMR Sep-2026 Release 1 allows local attackers to execute arbitrary code with system server privilege. |
CVE-2026-21086 | High | 7.8 | 2026-09-09 | Improper authorization in ProxyHandler prior to SMR Aug-2026 Release 1 allows local attackers to access proxy configuration. |
CVE-2026-21085 | Medium | 6.7 | 2026-09-09 | Out-of-bounds write in Keymaster trustlet prior to SMR Sep-2026 Release 1 allows local privileged attackers to write out-of-bounds memory. |
CVE-2026-19518 | Medium | 6.5 | 2026-08-11 | Improper Validation of Specified Quantity in Input vulnerability in Samsung Open Source rlottie allows Input Data Manipulation. |
CVE-2026-19517 | Medium | 6.5 | 2026-08-11 | Improper Validation of Specified Quantity in Input and Allocation of Resources Without Limits or Throttling vulnerability in Samsung Open Source rlottie allows… |
CVE-2026-21083 | Medium | 6.5 | 2026-08-10 | Improper input validation in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to access sensitive data. |
CVE-2026-21082 | Medium | 5.5 | 2026-08-10 | Relative path traversal in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information. |
CVE-2026-21080 | Medium | 6.5 | 2026-08-10 | Cleartext storage of sensitive information in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to access sensitive data. |
CVE-2026-21079 | Medium | 6.5 | 2026-08-10 | Missing encryption of sensitive data in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to intercept transmitted data. |
CVE-2026-21078 | Medium | 6.5 | 2026-08-10 | Insufficient verification of data authenticity in Smart Switch trouble scanning mode prior to version 3.7.72.6 allows adjacent attackers to spoof device identi… |
CVE-2026-21077 | Medium | 5.5 | 2026-08-10 | Incorrect authorization in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information. |
CVE-2026-21076 | Medium | 5.5 | 2026-08-10 | Incorrect authorization in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information. |
CVE-2026-21073 | Medium | 6.1 | 2026-08-10 | Improper input validation in Galaxy Themes prior to SMR Aug-2026 Release 1 allows physical attackers to launch arbitrary activity. |
CVE-2026-21072 | High | 7.8 | 2026-08-10 | Improper input validation in VC1 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory. |
CVE-2026-21071 | High | 7.8 | 2026-08-10 | Improper input validation in MPEG4 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory. |
CVE-2026-21070 | Medium | 4.6 | 2026-08-10 | Improper input validation in Samsung Message prior to SMR Aug-2026 Release 1 allows physical attackers to access sensitive information. |
CVE-2026-21069 | High | 7.8 | 2026-08-10 | Incorrect conversion between numeric types in VC1 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory. |
CVE-2026-21068 | High | 7.8 | 2026-08-10 | Stack-based buffer overflow in libril_sem.so prior to SMR Aug-2026 Release 1 allows privileged local attackers to execute arbitrary code. |
CVE-2026-21067 | High | 7.8 | 2026-08-10 | Improper input validation in libsmsd.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory. |
CVE-2026-21066 | High | 7.8 | 2026-08-10 | Improper input validation in libcodec2_sec_flacdec.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory. |
CVE-2026-21065 | High | 7.8 | 2026-08-10 | Out-of-bounds write in libcodec2secqcelpdec.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory. |
CVE-2026-21064 | Medium | 5.5 | 2026-08-10 | Improper access control in Weaver prior to SMR Aug-2026 Release 1 allows local attackers to cause device inoperability. |
CVE-2026-21063 | Medium | 6.1 | 2026-08-10 | Improper export of android application components in AppLock prior to SMR Aug-2026 Release 1 allows physical attackers to bypass app lock function. |
CVE-2026-21062 | Low | 3.3 | 2026-08-10 | Authorization bypass in SemClipboardService prior to SMR Aug-2026 Release 1 allows local attackers to access clipboard data. |
CVE-2026-21061 | Medium | 6.5 | 2026-08-10 | Improper input validation in Samsung Dialer prior to SMR Aug-2026 Release 1 allows remote attackers to access SIM related functions. User interaction is requir… |
CVE-2026-21060 | Medium | 4.6 | 2026-08-10 | Improper input validation in Samsung Contacts prior to SMR Aug-2026 Release 1 allows physical attackers to access data across multiple user profiles. |
CVE-2026-21059 | High | 7.1 | 2026-08-10 | Improper export of android application components in Samsung Contacts prior to SMR Aug-2026 Release 1 allows local attackers to delete file with Samsung Contac… |
CVE-2026-21058 | High | 7.1 | 2026-08-10 | Improper input validation in Samsung Contacts prior to SMR Aug-2026 Release 1 allows local attackers to delete file with Samsung Contacts' privilege. |
CVE-2026-18772 | Medium | 6.5 | 2026-08-04 | Improperly controlled sequential memory allocation vulnerability in Samsung Open Source rlottie allows Exponential Data Expansion. |
CVE-2026-28573 | Medium | 5.5 | 2026-06-18 | In AndroidManifest.xml, there is a possible persistent denial of service due to a missing permission check. This could lead to local denial of service with no… |
CVE-2026-21038 | Medium | 5.5 | 2026-06-05 | Improper input validation in Samsung Android USB Driver for Windows prior to version 1.9.5.0 allows local attacker to access out-of-bounds memory. |
CVE-2026-21037 | High | 7.1 | 2026-06-05 | Improper input validation in Samsung Members prior to version 5.8.01.5 allows local attackers to access arbitrary URL and launch arbitrary activity with Samsun… |
CVE-2026-21036 | Medium | 5.5 | 2026-06-05 | Improper authorization in Samsung Internet prior to version 30.0.0.39 allows local attackers to access sensitive information. |
CVE-2026-21035 | High | 7.5 | 2026-06-05 | Improper input validation in Samsung Plus TV prior to version 1.0.28.6 allows remote attackers to access sensitive information. |
CVE-2026-21034 | Low | 3.3 | 2026-06-05 | Improper export of android application components in Samsung Auto prior to version 3.1.2.61 in Android 15 and 3.2.0.38 in Android 16 allows local attacker to c… |
CVE-2026-21033 | High | 7.1 | 2026-06-05 | Improper export of android application components in ExpressHomeWidgetReceiver of Samsung Assistant prior to version 9.3.14 allows local attacker to execute ar… |
CVE-2026-21032 | High | 7.1 | 2026-06-05 | Improper export of android application components in SmartHomeWidgetReceiver of Samsung Assistant prior to version 9.3.14 allows local attacker to execute arbi… |
CVE-2026-21031 | High | 7.8 | 2026-06-05 | Improper authorization in AppBlock prior to SMR Jun-2026 Release 1 allows local attacker to launch arbitrary activity. User interaction is required for trigger… |
CVE-2026-21030 | High | 7.8 | 2026-06-05 | Improper access control in MediaTek Audio HAL prior to SMR Jun-2026 Release 1 allows local attackers to trigger privileged functions. |
CVE-2026-21029 | High | 7.8 | 2026-06-05 | Improper export of android application components in Galaxy Editing Service prior to SMR Jun-2026 Release 1 allows local attacker to execute privileged operati… |
CVE-2026-21028 | Medium | 5.5 | 2026-06-05 | Improper access control in AuditLogService prior to SMR Jun-2026 Release 1 allows local attackers to access sensitive information. |
CVE-2026-21027 | Low | 3.3 | 2026-06-05 | Improper export of android application components in ImsSettings prior to SMR Jun-2026 Release 1 allows local attackers to trigger logging function. |
CVE-2026-21026 | Medium | 5.5 | 2026-06-05 | Improper export of android application components in SpriteWallpaper prior to SMR Jun-2026 Release 1 allows local attackers to access to sensitive information. |
CVE-2026-21025 | Medium | 5.5 | 2026-06-05 | Incorrect privilege assignment in Telephony prior to SMR Jun-2026 Release 1 allows local attackers to access sensitive information. |
CVE-2026-21017 | Medium | 5.5 | 2026-06-05 | Improper handling of insufficient privileges in SecTelephonyProvider prior to SMR Jun-2026 Release 1 allows local attackers to access privileged files. |
CVE-2026-8915 | High | 8.8 | 2026-05-28 | Out-of-bounds write vulnerability in Samsung Open Source Escargot allows Overflow Buffers. This issue affects Escargot: 36f5fb58366a67b713c02f6fd985e924fcc09e… |
CVE-2026-47317 | Medium | 5.5 | 2026-05-19 | Uncontrolled Recursion vulnerability in Samsung Open Source Escargot allows Excessive Allocation. This issue affects Escargot: 590345cc6258317c5da850d846ce6ba… |
CVE-2026-47316 | Medium | 5.5 | 2026-05-19 | Improper Check or Handling of Exceptional Conditions vulnerability in Samsung Open Source Escargot allows Input Data Manipulation. This issue affects Escargot… |
CVE-2026-47315 | Medium | 5.5 | 2026-05-19 | Improper Check for Unusual or Exceptional Conditions vulnerability in Samsung Open Source Escargot allows Input Data Manipulation. This issue affects Escargot… |
CVE-2026-47314 | High | 7.8 | 2026-05-19 | Out-of-bounds write vulnerability in Samsung Open Source Escargot allows Overflow Buffers. This issue affects Escargot: 590345cc6258317c5da850d846ce6baaf2afc2… |
CVE-2026-47313 | Medium | 5.5 | 2026-05-19 | Memory allocation with excessive size value vulnerability in Samsung Open Source Escargot allows Excessive Allocation. This issue affects Escargot: 590345cc62… |
CVE-2026-47312 | Medium | 5.5 | 2026-05-19 | Release of invalid pointer or reference vulnerability in Samsung Open Source Escargot allows Buffer Manipulation. This issue affects Escargot: 590345cc6258317… |
CVE-2026-47311 | High | 7.8 | 2026-05-19 | Heap-based buffer overflow vulnerability in Samsung Open Source Escargot allows Overflow Buffers. This issue affects Escargot: 590345cc6258317c5da850d846ce6ba… |
CVE-2026-47310 | High | 7.8 | 2026-05-19 | Use after free vulnerability in Samsung Open Source Escargot allows Pointer Manipulation. This issue affects Escargot: 590345cc6258317c5da850d846ce6baaf2afc2d… |
CVE-2026-47309 | Medium | 5.5 | 2026-05-19 | Uncontrolled Recursion vulnerability in Samsung Open Source Escargot allows Oversized Serialized Data Payloads. This issue affects Escargot: 590345cc6258317c5… |
CVE-2026-47308 | Medium | 5.5 | 2026-05-19 | NULL pointer dereference vulnerability in Samsung Open Source Walrus allows Pointer Manipulation. This issue affects Walrus: f339b8ee4ea701772e8ae640b3d1b12ac… |
CVE-2026-47307 | Medium | 5.5 | 2026-05-19 | NULL pointer dereference vulnerability in Samsung Open Source Walrus allows an attacker to cause a denial of service via a crafted WebAssembly module containin… |
CVE-2026-21022 | Medium | 5.5 | 2026-05-13 | Improper handling of insufficient permissions in Routines prior to SMR May-2026 Release 1 allows local attackers to access sensitive information. |
CVE-2026-21021 | Medium | 6.8 | 2026-05-13 | Improper input validation in Routines prior to SMR May-2026 Release 1 allows physical attackers to launch privileged activity. |