CVE-2026-23789: Samsung Exynos MFC double-free in encoder driver

CVE-2026-23789 · Severity: high · CVSS 7.8 · Published 2026-09-14

Samsung Exynos processors contain a double-free vulnerability in the Media Format Converter (MFC) encoder driver used for video encoding on mobile devices and wearables. Improper cleanup of memory references during error handling allows an attacker to corrupt kernel memory and potentially execute arbitrary code, affecting millions of smartphones and wearable devices globally.

Technologies: Samsung Exynos 2600, Samsung Exynos 1080, Samsung Exynos 1280, Samsung Exynos 1330, Samsung Exynos 1380, Samsung Exynos 1480, Samsung Exynos 1580, Samsung Exynos 1680, Samsung Exynos 2100, Samsung Exynos 2200, Samsung Exynos 2400, Samsung Exynos 2500, Samsung Exynos 850, Samsung Exynos W1000, Samsung Exynos W920, Samsung Exynos W930. Vendors: Samsung.

Quick answers

Is CVE-2026-23789 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-23789 being exploited in the wild.
How severe is CVE-2026-23789?
High severity, with a CVSS score of 7.8, published 14 September 2026.
Which products and versions are affected?
Samsung Exynos 2600 all; Samsung Exynos 1080 all; Samsung Exynos 1280 all; Samsung Exynos 1330 all; and 12 more.
Is there a fix for CVE-2026-23789?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-23789 attacked?
It is attacked with local access.
Am I affected by CVE-2026-23789?
Check whether you run Samsung Exynos 2600, Samsung Exynos 1080, Samsung Exynos 1280 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A double-free vulnerability exists in the Exynos MFC encoder driver due to improper cleanup of DMA buffer references during error handling. The vulnerability is rooted in the resource management logic of the MFC encoder, which fails to properly release memory references when an error occurs, allowing the same memory region to be freed twice. This can be triggered by applications with access to the MFC hardware encoder (typically through system APIs), leading to kernel memory corruption. An attacker can exploit this to achieve arbitrary code execution in the kernel context. Patches are available from Samsung for affected Exynos processors.

Affected products

  • Samsung Exynos 850 all
  • Samsung Exynos 1080 all
  • Samsung Exynos 2100 all
  • Samsung Exynos 1280 all
  • Samsung Exynos 2200 all
  • Samsung Exynos 1330 all
  • Samsung Exynos 1380 all
  • Samsung Exynos 1480 all
  • Samsung Exynos 2400 all
  • Samsung Exynos 1580 all
  • Samsung Exynos 2500 all
  • Samsung Exynos 2600 all
  • Samsung Exynos 1680 all
  • Samsung Exynos W920 all
  • Samsung Exynos W930 all
  • Samsung Exynos W1000 all

Timeline

  • 2025-12-23: disclosed: CVE reported date
  • 2026-09-14: advisory: Published on NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.