Technical impact
The vulnerability is a heap overflow in the Exynos DRM HDR driver caused by improper buffer size validation, which leads to kernel memory corruption and crashing the system. The flaw falls under CWE-122 (Heap Buffer Overflow) and can cause a denial of service via kernel panic.
Affected Systems
Affected vendors include Samsung, with the flaw present in the Exynos 1280 firmware (and the description also mentions the 2200 and 1380 lines). The vulnerability exists in the firmware that ships with these mobile processors; specific affected firmware versions are not listed in the advisory, so any device running the default firmware before the vendor’s update may be impacted.
Risk and Exploitability
The CVSS score of 4.2 indicates moderate severity, and the EPSS score of less than 1% along with its absence from the KEV catalog suggests it is not widely exploited yet. The attack vector is inferred to be local or requires privileged access to invoke DRM HDR operations, since the overflow occurs within a kernel module. Until an update is applied, devices could experience repeated crashes if the vulnerable interface is used.
