busung-dev/cve-2026-43499-s25u

This repository is a proof of concept exploit for a specific security vulnerability, tracked as CVE-2026-43499, built and tested against one exact phone model and firmware build: the Korean Samsung Galaxy S25 Ultra, model number SM-S938N, running Android 16 with build S938NKSUACZF1. A CVE is a publicly tracked identifier for a known security flaw, and a proof of concept is code written to demonstrate that the flaw is real and can actually be used, rather than just described in theory. The memory offsets and internal data layouts used here are tied specifically to that firmware build, so the code will not work correctly on a different phone or a different software version without modification. The project is a device-specific port of an existing exploit published by another security research group, with the original license, Apache 2.0, kept intact. The changes made for this port include memory offsets and kernel layout details specific to this device, a method for recovering the kernel's address randomization on this particular Samsung kernel using tracefs, and device-specific timing adjustments to make a race condition attack more reliable. Building it requires the Android NDK, a toolkit for compiling native code for Android, and produces two output binaries. Those binaries are pushed onto the phone using adb, Android's official device debugging tool, given execute permission, and then run in a specific sequence. If successful, the exploit grants a temporary root shell, meaning full administrative access to the device that persists only until the phone is rebooted. Environment variables let you tune how many attempts the exploit makes and the timing delay between steps. The author points to a separate companion project for people who want a simpler one-click installer with additional root management support, rather than running this raw proof of concept directly. The README closes with an explicit warning that this code should only be used on a device you own or have clear authorization to test, since deliberately exploiting security flaws on devices you do not control is illegal in most places.