# CVE-2026-82927: Samsung mTower untrusted pointer dereference in secure-world boundary

Source: https://junglewise.ai/threats/cve-2026-82927-samsung-mtower-untrusted-pointer-dereference-in-secure-world  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-01. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-82927 · Severity: medium · CVSS 5.5 · Published 2026-09-01

Samsung mTower is a Trusted Execution Environment (TEE) implementation that provides a secure isolated execution environment for critical operations on Samsung devices. An attacker with access to the non-secure world can manipulate pointers passed to the secure world, potentially bypassing security isolation and gaining unauthorized access to sensitive data or disrupting TEE operations.

Technologies: [Samsung mTower](https://junglewise.ai/threats/technologies/mtower). Vendors: [Samsung](https://junglewise.ai/threats/vendors/samsung).

## Quick answers

**Is CVE-2026-82927 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82927 being exploited in the wild.

**How severe is CVE-2026-82927?** Medium severity, with a CVSS score of 5.5, published 1 September 2026.

**Which products and versions are affected?** Samsung mTower before 06994e303637512e39062f3e037c222e8448e57e.

**Is there a fix for CVE-2026-82927?** A patch was published on 2026-07-28: Fix merged in PR #250 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-82927 attacked?** It is attacked from the adjacent network.

**Am I affected by CVE-2026-82927?** Check whether you run Samsung mTower at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is an untrusted pointer dereference vulnerability in the secure-world boundary validation logic of Samsung mTower. The vulnerability occurs when the TEE fails to properly validate non-secure pointers passed from the normal world (non-secure context) before dereferencing them in the secure world. An attacker in the non-secure world can craft malicious pointer values to manipulate secure-world memory access, potentially reading/writing sensitive data or breaking TrustZone-M isolation guarantees. The fix was implemented in pull request #250 to add proper non-secure pointer validation at the secure-world boundary. This is a critical trust boundary violation affecting the core isolation mechanism of the TEE.

## Affected products

- Samsung mTower before 06994e303637512e39062f3e037c222e8448e57e

## Timeline

- 2026-09-01: disclosed
- 2026-07-28: patched: Fix merged in PR #250

## References

- [https://github.com/Samsung/mTower/pull/250](https://github.com/Samsung/mTower/pull/250)

## Related threats

- [Samsung mTower access control bypass in TA sessions](https://junglewise.ai/threats/cve-2026-125715-samsung-mtower-lacks-access-control-for-ta-sessions-allowing-a)
- [Samsung mTower untrusted pointer dereference in syscalls](https://junglewise.ai/threats/cve-2026-10420-samsung-mtower-untrusted-pointer-dereference-in-syscalls)
- [Samsung mTower NULL pointer dereference in TEE invoke](https://junglewise.ai/threats/cve-2026-82926-samsung-mtower-null-pointer-dereference-in-tee-invoke)