CVE-2026-33960

LowCVSS 2.8/10Last modified Sep 22, 2026

Description

An issue was discovered in Samsung Mobile Processor and Wearable Processor Exynos 1330, 1380, 1480, 1580, 1680, W920, W930, and W1000. . A malformed ioctl command to the Wi-Fi interface device can lead to improper buffer size allocation, resulting in an out-of-bounds write and causing a denial of service (DoS).

Metrics

CVSS 3.1 2.8/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L

Weakness enumeration

CWE-787

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Samsung	Exynos 1330 firmware	<= 2025-12-18

References

Timeline

Published: Sep 14, 2026
Last modified: Sep 22, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-339622.8An issue was discovered in Wi-Fi in Samsung Mobile Processor Exynos 850, 1280, 1330, 1380, 1480, 2400, W920, and W930. A malformed Netlink c CVE-2026-339637.5An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500, 2600, and 1680. A stack-based buffe CVE-2026-339646.4An issue was discovered in camera in Samsung Mobile Processor Exynos 1580 and 2500. An untrusted pointer dereference occurs when a malformed CVE-2026-339655.3An attacker may send a malicious IMS message to the target device, potentially leading to information exposure through the SIP message flow.CVE-2026-339662.8An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500, 2600, and 1680. An information Leak CVE-2026-339672.8An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500, 2600, and 1680. In the camera drive CVE-2026-339682.8An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500, 2600, and 1680. In the camera drive CVE-2026-339697.5In the NAS Authentication Request message decoding procedure, a missing lower bound check causes an infinite loop, leading to Denial of Serv CVE-2026-339703.5An issue was discovered in NR RRC and L2 in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 850, 1080, 2100, 1280, 2200, 1330 CVE-2026-339719.8In the LTE RRC component, improper handling of messages before authentication triggers a data abort, which leads to a denial‑of‑service cond CVE-2026-339729.8In the Exynos modem's IMS stack, Out of Bound access occurs due to improper validation.CVE-2026-339758.3Twenty is an open source CRM built with NestJS (Node.js). In versions 1.18.0 and earlier, the SSRF protection in twenty-server's SecureHttpC