CVE-2026-23791
Quick assessment
Affected
Samsung Exynos 1280 firmware
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在三星移动处理器 Exynos 1280、2200、1380、1480、2400、1580、2500、1680 和 2600 的显示处理单元（DPU）中发现了一个问题。由于 Exynos DPU 驱动程序在解析颜色模式查找表（LUT）时缺少对输入长度的校验，存在越界写入漏洞，可能导致内核内存损坏及潜在的特权提升。
Possible ATT&CK Techniques 1 AI
T1059 · Command and Scripting Interpreter
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-23791
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
An issue was discovered in DPU in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, and 2600. An out-of-bounds write vulnerability in the Exynos DPU driver (due to missing input length validation in color mode LUT parsing) leads to kernel memory corruption and potential privilege escalation.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存写
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Samsung | Exynos 1280 firmware | 0 ~ 2025-12-29 | - |
|
II. Public POCs for CVE-2026-23791
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-23791
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-23791 (1)
Same Patch Batch · Samsung · 2026-09-14 · 19 CVEs total
| CVE-2026-23789 | 7.8 HIGH | 三星Exynos MFC编码器double-free漏洞 |
| CVE-2026-33963 | 7.5 HIGH | 三星Exynos芯片组摄像头栈缓冲区溢出致拒绝服务 |
| CVE-2026-33964 | 6.4 MEDIUM | 三星Exynos 1580/2500相机模块指针解引用漏洞 |
| CVE-2026-23787 | 4.2 MEDIUM | 三星Exynos多款芯片DRM驱动UAF致内核崩溃 |
| CVE-2026-23788 | 4.2 MEDIUM | Exynos DPU堆溢出致系统崩溃 |
| CVE-2026-23790 | 4.2 MEDIUM | 三星Exynos DPU双释放导致内核内存损坏 |
| CVE-2026-33957 | 4.2 MEDIUM | 三星 Exynos 1580 驱动越界读写漏洞 |
| CVE-2026-23792 | 4.0 MEDIUM | 三星Exynos基带RRC未认证消息处理缺陷 |
| CVE-2026-23793 | 3.5 LOW | 三星Exynos系列芯片摄像头驱动越界访问致内核内存损坏 |
| CVE-2026-33970 | 3.5 LOW | 三星Exynos 5G基带RRC空指针解引用 |
| CVE-2023-37366 | 2.8 LOW | Google Pixel 安全漏洞 |
| CVE-2026-23786 | 2.8 LOW | Exynos处理器DRM驱动TOCTOU竞态致内核崩溃 |
| CVE-2026-33966 | 2.8 LOW | 三星Exynos 1330等芯片Camera驱动信息泄露 |
| CVE-2026-33968 | 2.8 LOW | 三星Exynos系列处理器Camera驱动TOCTOU越界 |
| CVE-2026-33967 | 2.8 LOW | Exynos系列处理器相机驱动越界访问致内存损坏 |
| CVE-2026-33960 | 2.8 LOW | Exynos系列Wi-Fi驱动越界写致拒绝服务 |
| CVE-2026-33962 | 2.8 LOW | Exynos多型号Wi-Fi Netlink命令越界读 |
| CVE-2026-33956 | 2.8 LOW | 三星Exynos芯片相机模块越界写导致服务中断 |
IV. Related Vulnerabilities
V. Comments for CVE-2026-23791
No comments yet