{"id":"CVE-2026-57047","kind":"vulnerability","aliases":["CVE-2026-57047"],"related":[],"title":"Samsung MFC codec: out-of-bounds write lets remote code run","description":"In __mfc_core_nal_q_get_dec_metadata_sei_nal of mfc_core_nal_q.c, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.","summary":"A missing bounds check in the Samsung multi-format codec (MFC) video decoder's SEI metadata handling allows an out-of-bounds write. The description says this can lead to remote code execution without extra privileges and without user interaction.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","infrastructure","samsung","video-decoder"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T20:19:18+00:00","first_seen_at":"2026-11-10T20:46:09+00:00","triaged_at":"2026-11-10T20:52:04+00:00","updated_at":"2026-11-10T20:52:04+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-11-10T20:52:04Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Samsung MFC codec: out-of-bounds write lets remote code run","impact":"high","summary":"A missing bounds check in the Samsung multi-format codec (MFC) video decoder's SEI metadata handling allows an out-of-bounds write. The description says this can lead to remote code execution without extra privileges and without user interaction.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["android","samsung","video-decoder"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker runs code remotely through crafted video data","analyst_note":"Identify affected Samsung devices, patched security bulletin month and fixed firmware from the NVD entry or Samsung security bulletins.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000649,"input_tokens":4566,"output_tokens":384,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-57047':15A,18A 'addit':106C 'allow':43B 'android':19B 'bound':7A,27B,48B,89C,95C 'check':28B,96C 'code':11A,58B,102C 'codec':3A,35B 'core':69C,79C 'could':98C 'cve':13A,16A 'dec':73C 'decod':24B,38B 'descript':51B 'due':91C 'execut':59B,103C,107C 'exploit':116C 'extra':61B 'format':34B 'get':72C 'handl':42B 'infrastructur':20B 'interact':66B,111C 'lead':55B,99C 'let':9A 'metadata':41B,74C 'mfc':2A,36B,68C,78C 'miss':26B,94C 'multi':33B 'multi-format':32B 'nal':70C,76C,80C 'need':109C,114C 'out-of-bound':4A,45B,86C 'possibl':85C 'privileg':62B,108C 'q':71C 'q.c':81C 'remot':10A,57B,101C 'run':12A 'samsung':1A,21B,31B 'say':52B 'sei':40B,75C 'user':65B,110C 'video':23B,37B 'video-decod':22B 'without':60B,64B 'write':8A,49B,90C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":null,"pkeys":[],"ptokens":[],"labels":["android","infrastructure","samsung","unknown","videodecoder"],"campaign_type":null,"search_a":"'-2026':14A,17A '-57047':15A,18A 'bound':7A 'code':11A 'codec':3A 'cve':13A,16A 'let':9A 'mfc':2A 'out-of-bound':4A 'remot':10A 'run':12A 'samsung':1A 'write':8A","search_b":"'allow':43B 'android':19B 'bound':27B,48B 'check':28B 'code':58B 'codec':35B 'decod':24B,38B 'descript':51B 'execut':59B 'extra':61B 'format':34B 'handl':42B 'infrastructur':20B 'interact':66B 'lead':55B 'metadata':41B 'mfc':36B 'miss':26B 'multi':33B 'multi-format':32B 'out-of-bound':45B 'privileg':62B 'remot':57B 'samsung':21B,31B 'say':52B 'sei':40B 'user':65B 'video':23B,37B 'video-decod':22B 'without':60B,64B 'write':49B","search_c":"'addit':106C 'bound':89C,95C 'check':96C 'code':102C 'core':69C,79C 'could':98C 'dec':73C 'due':91C 'execut':103C,107C 'exploit':116C 'get':72C 'interact':111C 'lead':99C 'metadata':74C 'mfc':68C,78C 'miss':94C 'nal':70C,76C,80C 'need':109C,114C 'out-of-bound':86C 'possibl':85C 'privileg':108C 'q':71C 'q.c':81C 'remot':101C 'sei':75C 'user':110C 'write':90C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T20:19:18+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-57047","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57047","severity":null,"published_at":"2026-11-10T20:19:18+00:00","modified_at":"2026-11-10T20:19:18+00:00","first_seen_at":"2026-11-10T20:46:09+00:00","fetched_at":"2026-11-10T20:46:09+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}