PT-2025-21235 · Samsung · Exynos

Ali Ranjbar + 3 · Published 2025-05-14 · Updated 2025-05-14 · CVE-2025-27891

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Samsung Mobile Processor, Wearable Processor, and Modem Exynos versions 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 9110, W920, W930, W1000, Modem 5123, Modem 5300, and Modem 5400

Description: The issue is related to the lack of a length check, which leads to out-of-bounds reads via malformed NAS packets.

Recommendations: For Samsung Mobile Processor, Wearable Processor, and Modem Exynos versions 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 9110, W920, W930, W1000, Modem 5123, Modem 5300, and Modem 5400, consider implementing a length check to prevent out-of-bounds reads. As a temporary workaround, consider restricting the processing of NAS packets to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2025-27891

Affected Products

Exynos

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-27891 · Security Note
• https://semiconductor.samsung.com/support/quality-support/product-security-updates · Vendor Advisory
• https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-27891 · Vendor Advisory
• https://t.me/cvetracker/23864 · Telegram Post
• https://twitter.com/CVEnew/status/1922765624679510405 · Twitter Post