CVE-2026-23789
An issue was discovered in MFC in Samsung Mobile Processor and Wearable Processor Exynos 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 2500, 2600, 1680, W920, W930, and W1000. A double-free vulnerability in the Exynos MFC encoder driver (due to improper cleanup of dma_buf references during error handling) leads to kernel memory corruption and potential arbitrary code execution.
Scoring
- Severity
- HIGH
- CVSS base score
- 7.8
- CVSS vector
- CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
- EPSS probability
- 0.11%
- CWE
- CWE-415
- Published
- 2026-09-14
- Last modified
- 2026-09-16
Affected products
- Samsung Exynos 850 firmware
Weakness type
Related vulnerabilities
- CVE-2021-21797 — An exploitable double-free vulnerability exists in the JavaScript implementation of Nitro Pro PDF. A specially crafted d
- CVE-2026-23918 — Apache HTTP Server: http2: double free and possible RCE on early reset
- CVE-2021-3492 — Ubuntu linux kernel shiftfs file system double free vulnerability
- CVE-2021-22600 — Double Free in net/packet/af_packet.c leading to priviledge escalation
- CVE-2020-1647 — Junos OS: SRX Series: Double free vulnerability can lead to DoS or remote code execution due to the processing of a specific HTTP message when ICAP redirect service is enabled
- CVE-2026-87585 — Double free in PDFium in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to potentially exe
- CVE-2024-27099 — Azure IoT Platform Device SDK Double Free Vulnerability
- CVE-2024-23809 — A double-free vulnerability exists in the BrainVision ASCII Header Parsing functionality of The Biosig Project libbiosig