CVE-2025-54328
A critical stack‑based buffer overflow exists in the SMS handling code of many Samsung Exynos processors. The flaw is triggered when parsing RP‑DATA SMS messages, allowing an attacker to corrupt memory and potentially take control of the device. It affects a wide range of Exynos chips used in smartphones, wearables, and modems.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Samsung Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 2500, 9110, W920, W930, W1000, Modem 5123, Modem 5300, Modem 5400 firmware and processor variants.
Real-world impact
An attacker who can send a specially crafted SMS to the device could overwrite memory, crash the system, or execute arbitrary code, potentially gaining full control of the device or causing a denial of service.
Why this severity
The CVSS score of 10 reflects that the vulnerability is exploitable over the network (any SMS can be sent), requires no user interaction, and grants the attacker full control (confidentiality, integrity, availability are all high).
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Apr 6, 2026 · Apr 6, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 24, 2026 · 11d agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- semiconductor.samsung.com/support/quality-support/pro…vendor advisory
- semiconductor.samsung.com/support/quality-support/pro…vendor advisory