PT-2025-21181 · Samsung · Exynos

Ali Ranjbar + 3 · Published 2025-05-14 · Updated 2025-06-25 · CVE-2025-26785

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Samsung Mobile Processor, Wearable Processor, and Modem Exynos versions 980 through 9825, versions 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 9110, W920, W930, W1000, Modem 5123, Modem 5300, and Modem 5400

Description: An issue was discovered in the NAS component of Samsung processors, which affects various models including Mobile Processor, Wearable Processor, and Modem Exynos. The issue is caused by a lack of length check, leading to out-of-bounds writes.

Recommendations: For all affected versions, consider applying a patch or fix that implements a proper length check to prevent out-of-bounds writes. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2025-26785

Affected Products

Exynos

References · 6

• https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-26785 · Vendor Advisory
• https://semiconductor.samsung.com/support/quality-support/product-security-updates · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-26785 · Security Note
• https://t.me/cvenotify/126640 · Telegram Post
• https://twitter.com/CVEnew/status/1922695656994636094 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1922766783104045449 · Twitter Post