What is the CVSS score of CVE-2025-52909?

CVE-2025-52909 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of N A are affected by CVE-2025-52909?

CVE-2025-52909 is a critical buffer overflow in Samsung Exynos Wi-Fi drivers affecting multiple chipset generations that allows unauthenticated remote code execution through network-accessible Wi-Fi…

How to fix or mitigate CVE-2025-52909?

Within 24 hours: Identify and inventory all Samsung devices with affected Exynos Wi-Fi chipsets (models 980, 850, 1280, 1330, 1380, 1480, 1580, W920, W930, W1000) across corporate mobile fleets, IoT infrastructure, and BYOD ecosystems using MDM/EMM systems and network scanning. Within 7 days: Contact Samsung Security Support for emergency patch ETA and interim firmware availability; implement network segmentation isolating Wi-Fi interfaces from critical systems; enable Wi-Fi packet inspection/filtering on enterprise gateways to block malformed NL80211 vendor commands. Within 30 days: Deploy vendor-released patches to 100% of affected devices immediately upon Samsung release; conduct forensic analysis for signs of exploitation; re-baseline network trust for affected device populations.

N A CVE-2025-52909

EUVD-2025-209267 CRITICAL

Classic Buffer Overflow (CWE-120)

2026-04-07 mitre

GHSA-j23g-4xqg-g9jh

Buffer Overflow Samsung N A

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Apr 07, 2026 - 15:00 euvd

EUVD-2025-209267

Analysis Generated

Apr 07, 2026 - 15:00 vuln.today

CVE Published

Apr 07, 2026 - 00:00 nvd

CRITICAL 9.8

DescriptionCVE.org

An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1280, 1330, 1380, 1480, 1580, W920, W930, and W1000. Incorrect Handling of the NL80211 vendor command leads to a buffer overflow via a certain ioctl message, issue 2 of 2.

AnalysisAI

Buffer overflow in Samsung Exynos Wi-Fi drivers (980, 850, 1280, 1330, 1380, 1480, 1580, W920, W930, W1000) allows unauthenticated remote attackers to execute arbitrary code with high integrity/confidentiality impact through malformed NL80211 vendor command ioctl messages. Improper input validation enables network-accessible exploitation without user interaction. CVSS 9.8 critical severity. No public exploit identified at time of analysis.

Technical ContextAI

Root cause: CWE-120 buffer overflow triggered via NL80211 vendor command handler processing within kernel Wi-Fi driver stack. Improper bounds checking on ioctl message parameters permits memory corruption. Affects Exynos mobile/wearable chipset firmware across multiple generations. CVSS AV:N indicates remotely exploitable attack surface through wireless network proximity.

RemediationAI

Vendor-released patch available per Samsung advisory at https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-52909/. Device manufacturers using affected Exynos chipsets must integrate Samsung-provided firmware updates into system images. End users should apply OEM security patches when available through device update mechanisms. For unpatched devices, disable Wi-Fi functionality to eliminate network attack surface until firmware updates deploy. Monitor Samsung Security Updates portal for chipset-specific remediation timelines and affected device model lists.