CVE-2026-33971

CriticalCVSS 9.8/10Last modified Nov 10, 2026

Description

In the LTE RRC component, improper handling of messages before authentication triggers a data abort, which leads to a denial‑of‑service condition.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-400

Affected software

VendorProductVersions
Samsung SemiconductorExynos 850< October 2026
Samsung SemiconductorExynos 2100< October 2026
Samsung SemiconductorExynos 1280< October 2026
Samsung SemiconductorExynos 2200< October 2026
Samsung SemiconductorExynos 1330< October 2026
Samsung SemiconductorExynos 1380< October 2026
Samsung SemiconductorExynos 1480< October 2026
Samsung SemiconductorExynos 2400< October 2026
Samsung SemiconductorExynos 1580< October 2026
Samsung SemiconductorExynos 2500< October 2026
Samsung SemiconductorExynos 1680< October 2026
Samsung SemiconductorExynos W920< October 2026
Samsung SemiconductorExynos W930< October 2026
Samsung SemiconductorExynos W1000< October 2026
Samsung SemiconductorExynos Modem 5410< October 2026

References

Timeline

Published
Nov 5, 2026
Last modified
Nov 10, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-339729.8In the Exynos modem's IMS stack, Out of Bound access occurs due to improper validation.CVE-2026-339758.3Twenty is an open source CRM built with NestJS (Node.js). In versions 1.18.0 and earlier, the SSRF protection in twenty-server's SecureHttpCCVE-2026-339769.6Notesnook is a note-taking app. Prior to version 3.3.11 on Web/Desktop and 3.3.17 on Android/iOS, a stored XSS in the Web Clipper rendering CVE-2026-339776.5FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, a malicious RDP server can crash the FreeRDP clienCVE-2026-339786.1Notesnook is a note-taking app focused on user privacy & ease of use. Prior to version 3.3.17, a stored XSS vulnerability exists in the mobiCVE-2026-339798.2Express XSS Sanitizer is Express 4.x and 5.x middleware which sanitizes user input data (in req.body, req.query, req.headers and req.params)CVE-2026-33988.8A vulnerability was determined in Tenda F453 1.0.0.3. Affected is the function fromAdvSetWan of the file /goform/AdvSetWan of the component CVE-2026-339808.1Azure Data Explorer MCP Server is a Model Context Protocol (MCP) server that enables AI assistants to execute KQL queries and explore Azure CVE-2026-339816.5changedetection.io is a free open source web page change detection tool. Prior to 0.54.7, the `jq:` and `jqraw:` include filter expressions CVE-2026-339828.1FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, there is a heap-buffer-overflow READ vulnerabilityCVE-2026-339836.5FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, progressive_decompress_tile_upgrade() detects a miCVE-2026-339847.5FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, in resize_vbar_entry() in libfreerdp/codec/clear.c
CVE-2026-33971: Critical severity, CVSS 9.8 | Vulnix