EUVD-2025-209268
GHSA-6279-562x-78g7
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | CVSS 9.8 reflects critical severity with network-accessible unauthenticated exploitation of Samsung Exynos and Modem processors spanning mobile, wearable, and infrastructure hardware. Out-of-bounds write in SMS TP-UD parsing enables remote code execution on billions of devices. Low EPSS (0.02%) indicates minimal observed exploitation activity currently, but the attack surface and device prevalence create substantial long-term risk. |
| Exploit ScenarioDerived | Attacker sends specially crafted SMS with mismatched TP-UDHI/UDL values to trigger out-of-bounds memory write on target device. No authentication required; attack executes at modem layer during packet processing. No public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 07, 2026
Out-of-bounds write in Samsung Exynos chipsets (processors 980/990/850/1080/2100/1280/2200/1330/1380/1480/2400/1580/2500/9110, wearables W920/W930/W1000, modems 5123/5300/5400) allows unauthenticated remote attackers to achieve arbitrary code execution via malformed SMS TP-UD packets. Exploitation occurs through TP-UDHI/UDL value mismatch during SMS message parsing, enabling network-level attacks without user interaction. No public exploit identified at time of analysis.
RemediationAI
Vendor-released security update available through Samsung Semiconductor product security updates portal. Device manufacturers using affected Exynos chipsets must integrate Samsung's firmware patches into end-user device updates. End users should apply latest security patches from device OEMs (smartphone/wearable manufacturers). No user-side workaround exists as vulnerability resides in baseband firmware. Organizations should monitor device manufacturer security bulletins for deployment timelines. Complete vendor advisory at https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-62818/ and general update portal at https://semiconductor.samsung.com/support/quality-support/product-security-updates/. EPSS indicates low observed exploitation activity.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Buffer overflow (CWE-787) in SMS Transfer Protocol User Data (TP-UD) parser. Mismatch between User Data Header Indicator (TP-UDHI) flag and User Data Length (UDL) field triggers memory corruption during baseband modem processing. Attack surface exposed through standard cellular SMS delivery mechanisms requiring no physical device access.
Know when N A gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 2500, 9110, W920, W930, W1000, Modem 5123, Modem 5300, and Modem 5400. An out-of-bounds write occurs due to a mismatch between the TP-UDHI and UDL values when processing an SMS TP-UD packet.
Executive ViewAI
CVE-2025-62818 is a critical remote code execution vulnerability affecting Samsung Exynos chipsets used in Galaxy smartphones, tablets, wearables, and modems that allows unauthenticated attackers to execute arbitrary code through specially crafted SMS messages without user interaction. This vulnerability impacts the entire Samsung mobile device ecosystem and poses immediate risk to organizational BYOD programs, enterprise device fleets, and mobile-dependent business operations due to the wide chipset deployment and network-level attack vector.
No vendor-released patch identified at time of analysis. Interim mitigations: disable SMS-based services and authentication where possible; enforce network-level SMS filtering and inspection; restrict affected devices from handling sensitive business functions; monitor for indicators of compromise (unexpected code execution, device degradation, unauthorized data access); maintain offline backups of critical data from affected devices; consider temporary device replacement or device-class restrictions pending patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Exploit-DB