What is the CVSS score of CVE-2025-23107?

CVE-2025-23107 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L. EPSS exploitation probability: 0.1%.

Which versions of Exynos 1480 Firmware are affected by CVE-2025-23107?

CVE-2025-23107 affects Samsung Exynos mobile processors (1480 and 2400) used in Galaxy devices, enabling remote code execution through memory corruption.

How to fix or mitigate CVE-2025-23107?

Within 24 hours: Inventory all Samsung devices using Exynos 1480/2400 processors and restrict their network access to essential functions only. Within 7 days: Issue security advisory to device users; disable unnecessary features and enforce strict network segmentation for affected devices. Within 30 days: Monitor Samsung security bulletins for patch availability; prepare deployment procedures and test patches in non-production environments before rollout.

Exynos 1480 Firmware CVE-2025-23107

EUVD-2025-16769 HIGH

Out-of-bounds Write (CWE-787)

2025-06-03 cve@mitre.org

Buffer Overflow Samsung Exynos 1480 Firmware Exynos 2400 Firmware

8.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 17:04 euvd

EUVD-2025-16769

Analysis Generated

Mar 14, 2026 - 17:04 vuln.today

CVE Published

Jun 03, 2025 - 17:15 nvd

HIGH 8.6

DescriptionCVE.org

An issue was discovered in Samsung Mobile Processor Exynos 1480 and 2400. The lack of a length check leads to out-of-bounds writes.

AnalysisAI

Critical out-of-bounds write vulnerability in Samsung's Exynos 1480 and 2400 mobile processors caused by insufficient length validation. This vulnerability affects Samsung Galaxy devices and other OEM devices utilizing these SoCs, allowing remote, unauthenticated attackers to execute code with high integrity impact and potential system compromise. The high CVSS score of 8.6 reflects the network-exploitable nature and lack of authentication requirements, though real-world exploitation depends on the specific attack surface exposed in affected device implementations.

Technical ContextAI

The vulnerability resides in Samsung's Exynos mobile processor line (specifically the 1480 and 2400 models), which serve as the primary system-on-chip (SoC) for Samsung Galaxy flagship devices and are licensed to other OEMs. The root cause is classified as CWE-787 (Out-of-bounds Write), which occurs when code writes data beyond the boundaries of an allocated memory buffer without proper length validation. This typically manifests in processor firmware, bootloader, or secure enclave components that parse untrusted input without bounds checking. The lack of a length check suggests the vulnerability exists in a parsing routine—possibly in modem firmware processing, secure element communication, or inter-processor communication (IPC) mechanisms—where an attacker can supply malformed packets or messages that exceed expected buffer sizes, corrupting adjacent memory regions.

RemediationAI

Users with affected devices (Galaxy S24 series, S24 FE, and related models) should immediately apply the latest available firmware/security updates through Settings > System > System Update > Check for Updates or via Samsung's SmartSwitch software. OEMs using Exynos 1480/2400 should contact Samsung for emergency firmware patches. Samsung will release fixes through monthly security updates (likely available in January 2025 or sooner depending on discovery/disclosure timeline). Users unable to patch immediately should: (1) disable unnecessary network-exposed services and features, (2) avoid connecting to untrusted networks, (3) use VPN or network segmentation where possible, and (4) monitor Samsung's Security Advisory and Mobile Security Release Notes for specific CVE guidance. No known workarounds exist for this processor-level vulnerability; patching is the only mitigation. Vendor advisories and detailed patch notes should be monitored at security.samsungmobile.com and Samsung's official security bulletin pages.