CVE-2026-23789: Double Free

Published Sep 14, 2026

Updated

An issue was discovered in MFC in Samsung Mobile Processor and Wearable Processor Exynos 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 2500, 2600, 1680, W920, W930, and W1000. A double-free vulnerability in the Exynos MFC encoder driver (due to improper cleanup of dmabuf references during error handling) leads to kernel memory corruption and potential arbitrary code execution.

Affected Software

1 affected component

Samsung MFC (Media Framework Codec)=Exynos 850, =Exynos 1080, =Exynos 2100, =Exynos 1280, =Exynos 2200, =Exynos 1330, =Exynos 1380, =Exynos 1480, =Exynos 2400, =Exynos 1580, =Exynos 2500, =Exynos 2600, =Exynos 1680, =Exynos W920, =Exynos W930, =Exynos W1000

Event History

Sep 14, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·02:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which systems should be prioritized for review?

Systems using Exynos 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 2500, 2600, 1680, W920, W930, or W1000 processors should be reviewed, as the affected component is the Exynos MFC encoder driver.

What access does an attacker need to exploit this issue?

The CVSS vector indicates local attack access, low privileges, no user interaction, and high attack complexity. The supplied data does not indicate a remote network attack path.

What is the potential consequence of successful exploitation?

Improper cleanup of dma_buf references during error handling can cause a double-free, resulting in kernel memory corruption. This may allow arbitrary code execution with high impacts to confidentiality, integrity, and availability.