CVE-2026-43499-S24U

适用于 Galaxy S24 Ultra SM-S928U1 的 CVE-2026-43499 PoC CVE-2026-43499 的美版三星 Galaxy S24 Ultra 设备专属研究移植，固件版本 S928USQS6DZF2 （应用域 / 生产路径）。 本仓库是 CVE-2026-43499-S25U 的 S24U 对应版本，记录了当前未完成 的进展：控制面和残余栈 UAF 武装已就位；但尚未实现干净的 gate 写入（hits0）。 支持的目标设备 root@kitploit: Model: SM-S928U1 Codename: e3q Android: 14 /...

Samsung S24 MP3 Decoder Out-Of-Bounds Read

There is an out-of-bounds read in the MP3 decoder in the Samsung S24. The function smp123djointstereov1 indexes into several tables for decoding, and does not check that the index is valid, allowing the tables to be read out of bounds. It may be possible to use this bug to bypass ASLR, as loading...

Samsung S24 VC1 Decoder Out-Of-Bounds Memset

There are several calls to memset in the vc1 decoder on the Samsung S24, which can write out of bounds of a heap buffer. The length of the memsets in svc1expandrightapfrm are calculated based on length values that don't always correspond to the heap buffer length...

Samsung S24 MP3 Decoder Out-Of-Bounds Read

There is an out-of-bounds read in the MP3 decoder in the Samsung S24. The function smp123djointstereov1 indexes into several tables for decoding, and does not check that the index is valid, allowing the tables to be read out of bounds. It may be possible to use this bug to bypass ASLR, as loading...