{"id":"CVE-2026-10420","details":"Untrusted pointer dereference vulnerability in Samsung Open Source mTower allows Pointer Manipulation.\n\nThis issue affects mTower: before 102d3dc75cf8e58e68e4bea54ae3c803992c91be.","modified":"2026-10-08T07:06:30.833393745Z","published":"2026-09-01T11:08:49.869Z","database_specific":{"cna_assigner":"samsung.tv_appliance","cwe_ids":["CWE-822"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10420.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10420.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10420"},{"type":"FIX","url":"https://github.com/Samsung/mTower/pull/252"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/samsung/mtower","events":[{"introduced":"0"},{"fixed":"102d3dc75cf8e58e68e4bea54ae3c803992c91be"}]}],"versions":["v0.6.0","v0.5.0","v0.4.1","v0.4.0","v0.3.0","v0.2.0","v0.1.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-10420.json","vanir_signatures":[{"id":"CVE-2026-10420-1166e0f2","signature_type":"Function","signature_version":"v1","source":"https://github.com/samsung/mtower/commit/102d3dc75cf8e58e68e4bea54ae3c803992c91be","target":{"function":"main","file":"arch/cortex-m33/mps2/src/mps2_an505_qemu/secure/main.c"},"deprecated":false,"digest":{"function_hash":"260905739373261755324389846720463971379","length":774}},{"signature_version":"v1","source":"https://github.com/samsung/mtower/commit/102d3dc75cf8e58e68e4bea54ae3c803992c91be","target":{"file":"arch/cortex-m33/mps2/src/mps2_an505_qemu/secure/main.c"},"deprecated":false,"digest":{"line_hashes":["70451005702251187830237298754640196220","289553390641113917597893145757715909166","298189420705912996451982424134787961374","131586555754306315881307202344271273317","10115751519185765513693763902310147655","277408650068239209979547087357689776120","6960275836628395820582317759991832202","66582772670495106663394486023141736943","128233727445404252689751375456400118974","169717260084519693737529142370007077601","311081403381607358075620954963961444687","158784978788303522160508711540850357370"],"threshold":0.9},"id":"CVE-2026-10420-8f22f14d","signature_type":"Line"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/samsung/mtower/commit/102d3dc75cf8e58e68e4bea54ae3c803992c91be","target":{"file":"apps/access_rights_test/access_rights_test.c","function":"check"},"deprecated":false,"digest":{"function_hash":"245054537916054145703303984402937374406","length":322},"id":"CVE-2026-10420-a76b6d9e"},{"deprecated":false,"digest":{"length":809,"function_hash":"181148444266959367786721434414403645351"},"id":"CVE-2026-10420-d72d4dac","signature_type":"Function","signature_version":"v1","source":"https://github.com/samsung/mtower/commit/102d3dc75cf8e58e68e4bea54ae3c803992c91be","target":{"file":"apps/access_rights_test/access_rights_test.c","function":"tee_access_rights_test"}},{"signature_version":"v1","source":"https://github.com/samsung/mtower/commit/102d3dc75cf8e58e68e4bea54ae3c803992c91be","target":{"file":"apps/access_rights_test/access_rights_test.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["80507369231875887172967310722704963954","1584393128028688158101579122022235259","169211230776187683150323054378280772700","28758234326612637973569258063052256836","188201370831517169840770702965771674745","165906214967936862467154578534868615764","246133891215263438501536692413769441753","301299722786107592275664900443585766801","241126298068229508818624838390734441690","312451765464164298616898086625065545409","71655194653249756100758333275896372888","166369294474221357079373475932451814713","146268388982949715400710732730410438341","244731844805845854388754753936586985653","170979445998718515991443039049044611601","48610756462452163280636397057710970049","265139764687897135533762302969526583794","120483484651999329315617568945936786816","92010273993708115609070862164214449647","92836206561376073696925139394598789215","142283450433461413563527963055880900018","30946353256839304339275858640475890237","7328529161147187825465968734758295645","295159939199702863897654354594295019040","194447708478441947170597066296728682555","84043075268797780229249912414703020921","72947490071310808600477070748707854311","211902884210167270827590158396343321118","78134768097890824751964949901615337769","316007821086689770397787415176589008310","54832968841150050140193386671102798966","332754827771675213706554886869770370813","140686711519465374332876418011008710315","176549060705809648459760789775920182766","50398101931775608470168578560138236212","202085557709444967784572836486939954388"]},"id":"CVE-2026-10420-f986b8a3","signature_type":"Line"}],"vanir_signatures_modified":"2026-10-08T07:06:30Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}]}