Loading story…
An actively exploited use-after-free vulnerability in Samsung’s Exynos media-driver memory-mapping code enabled Android kernel privilege escalation. Tracked as CVE-2024-44068, the flaw affects devices using Exynos 9820, 9825, 980, 990, 850, and W920 processors on releases before SMR-Oct-2024. Project Zero’s analysis found that the exploit was part of a chain in which the attacker already had arbitrary code execution in the privileged cameraserver process; it was not a standalone initial-access exploit.
The vulnerability allowed physical memory to be freed while it remained mapped for hardware access through the m2m1shot_scaler0 driver. The attacker used that condition to overwrite page-table entries and implement a Kernel Space Mirroring Attack. The case adds an Android example to the mobile kernel-exploitation research Project Zero has also conducted on iOS. Samsung addressed the flaw in SMR-Oct-2024; organizations managing affected devices should verify installation of that update or a later applicable security release.
See which actors are running it and whether you're in range.
4 events from the most recent confirmed update back to the earliest known activity.
Samsung addressed the vulnerability in SMR-Oct-2024 and published a semiconductor product-security advisory. The report identifies October 7, 2024, as the disclosure or patch date; affected processors include Exynos 9820, 9825, 980, 990, 850, and W920.
The technical report explains how missing physical-page reference counting allowed freed memory to remain mapped for device access, enabling page-table corruption. It also documents exploit timing with mincore and process renaming assessed as likely anti-forensic behavior, without publishing a proof of concept or exploit sample.
Xingyu Jin of Google Devices & Services Security Research and Clement Lecigne of Google Threat Analysis Group reported the use-after-free vulnerability affecting Samsung Exynos media-driver memory mappings.
An analyzed CVE-2024-44068 exploit formed part of a privilege-escalation chain that already had arbitrary code execution in cameraserver. It exploited stale I/O memory mappings to corrupt page tables using a Kernel Space Mirroring Attack and worked on a Samsung Galaxy S10 running build G973FXXSGHWC2.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
googleprojectzero.github.io
Open sourcegoogleprojectzero.blogspot.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Samsung has patched three high-severity vulnerabilities in the Exynos NPU driver—`CVE-2025-23099`, `CVE-2025-23103`, and `CVE-2025-23107`—that could allow local privilege escalation on affected Galaxy devices. The flaws impact Samsung Galaxy S24+ devices running Android 14 and systems based on Exynos 1480 and 2400 platforms, and each issue is reachable by a malicious application running in the `untrusted_app` SELinux context with low privileges and no user interaction. Samsung assigned a CVSS v3.1 score of 7.8 to the bugs and released fixes through Product Security Updates in early June. The vulnerabilities stem from missing length checks in multiple NPU driver paths, leading to out-of-bounds writes in kernel memory. `CVE-2025-23099` involves queue preparation logic that can reuse smaller prior allocations while trusting larger attacker-controlled counts, `CVE-2025-23103` arises from an unbounded loop counter in `npu_queue_update` that can exceed the allocated `queue_list` size, and `CVE-2025-23107` affects `fill_vs4l_buffer`, which writes kernel-side buffer metadata into an undersized user-supplied structure. STAR Labs SG credited Billy Jheng Bing-Jhong, Muhammad Alifa Ramdhan, and Pan Zhenpeng with reporting the issues.
Jun 29, 2026
Researchers at LucidBit Labs disclosed **CVE-2026-20971**, a high-severity use-after-free flaw in Samsung’s **KNOX** framework that left millions of Galaxy devices exposed to potential kernel-level attacks for roughly eight years. The bug affected Galaxy **S9 through S25** models, tested **A-series** devices including the **A54**, and both **Exynos** and **Qualcomm** variants across Android **13, 14, 15, and 16**. Samsung said the issue was fixed in its **January 2026** Android security update, and users were urged to verify a security patch level of **`2026-01-01`** or later. The vulnerability was traced to a race condition between KNOX’s **PROCA** process authenticator and the **FIVE** kernel integrity subsystem, specifically involving `procfs` handlers under `/proc/pid/integrity/` that accessed a `task_integrity` object without a proper reference in a fully preemptive kernel. LucidBit said the flaw could let a local untrusted app trigger kernel memory corruption and identified exploitation primitives including a memory leak that could aid **KASLR** bypass, an arbitrary-call path mitigated by **KCFI**, and a constrained write through spinlock operations on reclaimed memory. Although exploitation required local access and user interaction, researchers warned that a compromised Galaxy device could still enable deeper device takeover and provide a foothold for attacks against enterprise environments.
Jun 29, 2026
Samsung disclosed multiple vulnerabilities affecting Galaxy devices, including **remote code execution** flaws in the proprietary Quram image codec and a separate **improper access control** bug in the Routines automation feature. **CVE-2025-21042** and **CVE-2025-21043** are out-of-bounds write issues in `libimagecodec.quram.so` that can be triggered by specially crafted images delivered through MMS, email attachments, messaging apps, or web content, potentially with little or no user interaction. Samsung said **CVE-2025-21042** was fixed in the **April 2025 Security Maintenance Release**, while **CVE-2025-21043** was addressed in the **September 2025 SMR**. The disclosures revive longstanding concerns around Samsung’s proprietary image parsing stack, which Google Project Zero previously showed could be exploited through malformed Qmage images in a **zero-click MMS** chain that achieved code execution on a Galaxy Note 10+. Samsung also patched **CVE-2025-21058**, which allowed a local attacker on Android 15 and 16 devices to execute arbitrary code with **SystemUI privileges** via Galaxy Routines before versions **4.8.7.1** and **4.9.6.0**. Separately, Google fixed Android framework flaw **CVE-2025-32322** in the September 2025 Android Security Bulletin after it was found to let a malicious app bypass the MediaProjection consent dialog and silently capture screen content on Android 13 and 14.
Jun 29, 2026