Is CVE-2026-23787 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-23787 being exploited in the wild.

How severe is CVE-2026-23787?

Medium severity, with a CVSS score of 4.2, published 14 September 2026.

Is there a fix for CVE-2026-23787?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-23787 attacked?

It is attacked with local access, in device firmware.

Am I affected by CVE-2026-23787?

Check whether you run Samsung Exynos 2600, Samsung Exynos 1280, Samsung Exynos 1380 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-23787: Samsung Exynos DRM HDR use-after-free in DPU

CVE-2026-23787 · Severity: medium · CVSS 4.2 · Published 2026-09-14

Samsung's Exynos mobile processors contain a use-after-free vulnerability in the Display Processing Unit (DPU) driver that can be triggered by improper cleanup when memory mapping operations fail. An attacker with local access to kernel interfaces could trigger a kernel crash, disrupting device operation and potentially enabling further system compromise.

Technologies: Samsung Exynos 2600, Samsung Exynos 1280, Samsung Exynos 1380, Samsung Exynos 1480, Samsung Exynos 1580, Samsung Exynos 1680, Samsung Exynos 2200, Samsung Exynos 2400, Samsung Exynos 2500. Vendors: Samsung.

Quick answers

Is CVE-2026-23787 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-23787 being exploited in the wild.
How severe is CVE-2026-23787?: Medium severity, with a CVSS score of 4.2, published 14 September 2026.
Which products and versions are affected?: Samsung Exynos 2600 <UNKNOWN>; Samsung Exynos 1280 <UNKNOWN>; Samsung Exynos 1380 <UNKNOWN>; Samsung Exynos 1480 <UNKNOWN>; and 5 more.
Is there a fix for CVE-2026-23787?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-23787 attacked?: It is attacked with local access, in device firmware.
Am I affected by CVE-2026-23787?: Check whether you run Samsung Exynos 2600, Samsung Exynos 1280, Samsung Exynos 1380 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A use-after-free vulnerability exists in the Exynos DRM HDR driver (DPU component) across multiple processor generations. The root cause is improper cleanup and error handling when vmap (kernel virtual memory mapping) operations fail, leaving freed memory references accessible. The vulnerability is triggered through local attack vectors; remote exploitation is unlikely unless combined with other privilege escalation techniques. Successful exploitation results in a kernel crash (denial of service), and may permit reading or writing kernel memory depending on heap state and attacker capabilities. Samsung has acknowledged the issue with a reported date of 2025-12-24.

Affected products

Samsung Exynos 1280 <UNKNOWN>
Samsung Exynos 2200 <UNKNOWN>
Samsung Exynos 1380 <UNKNOWN>
Samsung Exynos 1480 <UNKNOWN>
Samsung Exynos 2400 <UNKNOWN>
Samsung Exynos 1580 <UNKNOWN>
Samsung Exynos 2500 <UNKNOWN>
Samsung Exynos 1680 <UNKNOWN>
Samsung Exynos 2600 <UNKNOWN>

Timeline

2026-09-14: disclosed
2025-12-24: other: Reported date per Samsung

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.