CVE-2025-54329: samsung exynos_1280_firmware Heap-based Buffer Overflow

Vulnerability summary

CVE-2025-54329 is a high (CVSS 7.5) Heap-based Buffer Overflow vulnerability in samsung exynos_1280_firmware. EPSS estimates a 0.41% chance of exploitation in the next 30 days, higher than 34.2% of scored vulnerabilities.

Timeline

1. 04-11-2025
   PublishedVulnerability first disclosed.
2. 04-11-2025
   Last modifiedVulnerability information updated.

Description

An issue was discovered in NAS in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 2500, W920, W930, W1000, Modem 5123, Modem 5300, and Modem 5400. The function used to send a multiple-payloads message (including an SMS message) lacks bounds checking, which can lead to a heap overflow.

• CWE-122Heap-based Buffer OverflowA heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().