CVE-2026-33958

HighCVSS 7.5/10Last modified Nov 10, 2026

Description

Processing a malformed RRC Reconfiguration message leads to an out-of-bounds (OOB) access, resulting in a denial-of-service (DoS) condition.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-1286

Affected software

VendorProductVersions
Samsung SemiconductorExynos 1080< October 2026
Samsung SemiconductorExynos 2100< October 2026
Samsung SemiconductorExynos 1280< October 2026
Samsung SemiconductorExynos 2200< October 2026
Samsung SemiconductorExynos 1330< October 2026
Samsung SemiconductorExynos 1380< October 2026
Samsung SemiconductorExynos 1480< October 2026
Samsung SemiconductorExynos 2400< October 2026
Samsung SemiconductorExynos 1580< October 2026
Samsung SemiconductorExynos 2500< October 2026
Samsung SemiconductorExynos 1680< October 2026
Samsung SemiconductorExynos Modem 5123< October 2026
Samsung SemiconductorExynos Modem 5300< October 2026
Samsung SemiconductorExynos Modem 5400< October 2026
Samsung SemiconductorExynos Modem 5410< October 2026

References

Timeline

Published
Nov 5, 2026
Last modified
Nov 10, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-33967.5WCAPF – WooCommerce Ajax Product Filter plugin is vulnerable to time-based SQL Injection via the 'post-author' parameter in all versions up CVE-2026-339602.8An issue was discovered in Samsung Mobile Processor and Wearable Processor Exynos 1330, 1380, 1480, 1580, 1680, W920, W930, and W1000. . A mCVE-2026-339622.8An issue was discovered in Wi-Fi in Samsung Mobile Processor Exynos 850, 1280, 1330, 1380, 1480, 2400, W920, and W930. A malformed Netlink cCVE-2026-339637.5An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500, 2600, and 1680. A stack-based buffeCVE-2026-339646.4An issue was discovered in camera in Samsung Mobile Processor Exynos 1580 and 2500. An untrusted pointer dereference occurs when a malformedCVE-2026-339655.3An attacker may send a malicious IMS message to the target device, potentially leading to information exposure through the SIP message flow.CVE-2026-339662.8An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500, 2600, and 1680. An information LeakCVE-2026-339672.8An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500, 2600, and 1680. In the camera driveCVE-2026-339682.8An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500, 2600, and 1680. In the camera driveCVE-2026-339697.5In the NAS Authentication Request message decoding procedure, a missing lower bound check causes an infinite loop, leading to Denial of ServCVE-2026-339703.5An issue was discovered in NR RRC and L2 in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 850, 1080, 2100, 1280, 2200, 1330CVE-2026-339719.8In the LTE RRC component, improper handling of messages before authentication triggers a data abort, which leads to a denial‑of‑service cond
CVE-2026-33958: High severity, CVSS 7.5 | Vulnix