# CVE-2026-10420: Samsung mTower untrusted pointer dereference in syscalls

Source: https://junglewise.ai/threats/cve-2026-10420-samsung-mtower-untrusted-pointer-dereference-in-syscalls  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-01. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-10420 · Severity: medium · CVSS 5.5 · Published 2026-09-01

Samsung mTower is a trusted execution environment (TEE) component that provides a secure processing space isolated from the main operating system. An untrusted pointer dereference vulnerability allows a malicious or buggy trusted application to pass specially crafted pointer values to syscall handlers, potentially causing out-of-bounds memory access and compromising the integrity of the secure world. This could enable attackers to bypass security boundaries, leak sensitive data, or escalate privileges within the TEE.

Technologies: [Samsung mTower](https://junglewise.ai/threats/technologies/mtower). Vendors: [Samsung](https://junglewise.ai/threats/vendors/samsung).

## Quick answers

**Is CVE-2026-10420 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-10420 being exploited in the wild.

**How severe is CVE-2026-10420?** Medium severity, with a CVSS score of 5.5, published 1 September 2026.

**Which products and versions are affected?** Samsung mTower before 102d3dc75cf8e58e68e4bea54ae3c803992c91be.

**Is there a fix for CVE-2026-10420?** A patch was published on 2026-08-05: Fix merged in PR #252 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-10420 attacked?** It is attacked with local access, in device firmware.

**Am I affected by CVE-2026-10420?** Check whether you run Samsung mTower at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in mTower's copy helper functions (tee_svc_copy_to_user/tee_svc_copy_from_user) and crypto syscalls (utee_hash_update/final, utee_cipher_init, cipher_update, copy_in_attrs) that dereference or memcpy trusted application (TA)-supplied pointer ranges without proper validation. The root cause is that the tee_mmu_check_access_rights() guard was commented out or missing at multiple call sites. A malicious TA can pass NULL pointers, invalid ranges, or address-space-wrapping ranges to trigger out-of-bounds memory access in the secure kernel. The fix implements proper pointer validation in tee_mmu_check_access_rights() to reject NULL+len and wrapping ranges, then restores the guard at all vulnerable call sites. No per-TA MMU/MPU context means all access checks use TEE_MEMORY_ACCESS_ANY_OWNER, making strict bounds checking essential.

## Affected products

- Samsung mTower before 102d3dc75cf8e58e68e4bea54ae3c803992c91be

## Timeline

- 2026-09-01: disclosed
- 2026-08-05: patched: Fix merged in PR #252

## References

- [https://github.com/Samsung/mTower/pull/252](https://github.com/Samsung/mTower/pull/252)

## Related threats

- [Samsung mTower access control bypass in TA sessions](https://junglewise.ai/threats/cve-2026-125715-samsung-mtower-lacks-access-control-for-ta-sessions-allowing-a)
- [Samsung mTower untrusted pointer dereference in secure-world boundary](https://junglewise.ai/threats/cve-2026-82927-samsung-mtower-untrusted-pointer-dereference-in-secure-world)
- [Samsung mTower NULL pointer dereference in TEE invoke](https://junglewise.ai/threats/cve-2026-82926-samsung-mtower-null-pointer-dereference-in-tee-invoke)