CVE-2026-33968

Time-of-Check Time-of-Use Race Condition in Samsung Exynos Camera Driver

Published Sep 14, 2026 CVSS 3.1 · 2.8 Low EPSS < 1% KEV · Not listed

Description

An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500, 2600, and 1680. In the camera driver, a Time-of-Check Time-of-Use (TOCTOU) race condition leads to out-of-bounds access.

Analysis

Technical impact

The vulnerability is a Time-of-Check Time-of-Use race condition in the camera driver of Samsung Exynos processors. This flaw can cause an out-of-bounds memory access, potentially corrupting memory and leading to application crashes, device instability, or denial of service. The weakness is classified as a boundary error (CWE-125).

Affected Systems

Firmware for Samsung Exynos 1330 and several other variants—including 1380, 1480, 2400, 1580, 2500, 2600, and 1680—is affected and the vulnerability is already present in these firmware releases, pending a Samsung patch.

Risk and Exploitability

The CVSS score of 2.8 indicates low severity. The EPSS score is under 1 % and the vulnerability is not listed in CISA's KEV catalog. The attack vector is inferred to require local device access, as the issue originates in the camera driver, and the description does not specify remote exploitation corruption could cause device crashes or denial of service. Overall risk remains moderate, making monitoring and patching prudent.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Samsung

Exynos 1330 firmware

unknown

Version	Status	Constraints
`0`	affected	≤ 2025-12-15

No data.

Vendor Product Versions

Samsung

Exynos 1330 Firmware

Version	Status	Scheme	Platform
`[0,2025-12-15]`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply Samsung firmware update that fixes the camera driver race condition when it is released, restrict or disable camera functionality on the affected devices to prevent the race condition from being triggered.
Monitor device logs for camera-related crashes or abnormal behavior and report any incidents to Samsung support.
Restrict camera access at the operating‑system level by disabling the camera driver in the device’s BIOS/firmware registry or applying application permission controls to block non‑essential applications from using the camera.

Generated by OpenCVE AI on September 15, 2026 at 17:27 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Changed

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.124% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://semiconductor.samsung.com/support/quality-support/product-security-updates/
https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2026-33968/

History

Sep 15, 2026 5:45 PM Title updated View changes

Type	Values Removed	Values Added
Title		Time-of-Check Time-of-Use Race Condition in Samsung Exynos Camera Driver

Sep 14, 2026 11:15 PM Title updated View changes

Type	Values Removed	Values Added
Title	Exynos Camera Driver TOCTOU Race Condition Causing Out-of-Bounds Access

Sep 14, 2026 9:00 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 14, 2026 12:30 PM Title updated View changes

Type	Values Removed	Values Added
Title		Exynos Camera Driver TOCTOU Race Condition Causing Out-of-Bounds Access

Sep 14, 2026 2:45 AM Description updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500, 2600, and 1680. In the camera driver, a Time-of-Check Time-of-Use (TOCTOU) race condition leads to out-of-bounds access.
First Time appeared		Samsung Samsung exynos 1330 Firmware
Weaknesses		CWE-125
CPEs		cpe:2.3:a:samsung:exynos_1330_firmware::::::::
Vendors & Products		Samsung Samsung exynos 1330 Firmware
References		https://semiconductor.samsung.com/support/quality-support/product-security-updates/ https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2026-33968/
Metrics		cvssV3_1 `{'score': 2.8, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L'}`