CVE-2026-23789

A double-free flaw (CWE-415) in the Multi-Format Codec (MFC) encoder driver of Samsung's Exynos mobile and wearable processors is caused by improper cleanup of dma_buf references during error handling, corrupting kernel memory. It is triggered locally — for example by a malicious or compromised app that reaches the video encoder and forces the driver down a failure path — and yields kernel-level arbitrary code execution with a sandbox escape (CVSS 3.1: 7.8, AV:L/AC:H/PR:L/S:C). The affected silicon spans a broad range of Samsung Galaxy smartphones (from budget Exynos 850-class devices through flagship Exynos 2200/2400 parts) and Galaxy Watch wearables built on W920, W930, and W1000. Exploitation requires low privileges but high attack complexity (reliably racing the error path), making it most valuable as an elevation/sandbox-escape stage in a chained attack rather than a remote vector. No public proof-of-concept is known and the flaw is not in the CISA KEV, so exploitation status is currently none known.

What to do: Install the latest Samsung security software update (OTA, per the Samsung Monthly Security Bulletin) on all Galaxy phones and watches built on the listed Exynos SoCs, and verify the device's security patch level. Because the flaw is local and typically reached via media encoding from an app, restrict sideloaded and untrusted applications on managed devices. There is no effective workaround short of patching the kernel driver, so enterprise fleets should enforce minimum patch baselines via MDM.