Samsung Exynos EUVD-2026-77156

Exploitation requires the attacker to be within 5G NR radio-frequency range of the target device OR to control cellular radio infrastructure (rogue gNB/base station) capable of broadcasting 5G signals. The targeted device must be actively attempting NR RRC connection establishment - either on initial attach or after signal loss triggers re-registration. The chipset must be running the vulnerable Exynos NR baseband firmware (one of the 14 listed chipsets). No authentication is required to send downlink RRC Setup messages, as this is by design in the 3GPP specification at that protocol phase. Limiting factors: physical RF proximity or infrastructure access is mandatory; the attack cannot be launched from the public internet without controlling cellular radio equipment; impact is DoS only (crash/connectivity loss), not code execution or data theft; the attack targets only devices running one of the 14 affected Exynos chipsets and does not affect devices using non-Exynos modems (e.g., Qualcomm-based Samsung variants in some markets).

The official CVSS 3.1 base score of 4.0 (Medium) with vector AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L reflects a nuanced picture: while no privileges are required and no user interaction is needed, high attack complexity (AC:H) substantially reduces the practical risk - a rogue 5G base station or software-defined radio capable of injecting downlink RRC messages in close physical proximity to a victim device is required. The impact is limited to availability (baseband crash, loss of cellular service); confidentiality and integrity are unaffected. No active exploitation has been confirmed by CISA KEV, and no public exploit code is known, keeping the EPSS signal low for this type of baseband DoS. The AV:N metric in the official vector is arguably generous: the attack requires radio-frequency proximity or control of cellular infrastructure rather than pure internet reachability, making AV:A a more precise characterization. The S:C (Changed scope) metric is defensible if a baseband crash triggers a full device reboot, affecting the application processor. Even a mid-sized municipal IT team in rybnik managing a fleet of Samsung devices should treat this as a tracked but non-urgent patching priority - significant primarily for mobile operators and enterprise deployments relying on uninterrupted cellular connectivity. The 14-chipset breadth increases aggregate exposure across Samsung's device ecosystem, but the physical proximity requirement limits opportunistic mass exploitation. No POC or KEV confirmation elevates this beyond a theoretical-but-credible threat against targeted individuals (journalists, executives) in adversarial environments with RF capabilities.

An attacker with access to software-defined radio equipment or a rogue 5G base station positioned within radio range of a target device forces the victim device to attempt cellular registration. The attacker injects a malformed, unauthenticated NR RRC Setup message during the connection establishment phase, triggering the firmware defect and crashing the baseband modem, causing the device to lose all cellular connectivity until the modem resets or the device reboots. No public exploit code exists for this vulnerability, making this scenario currently feasible only for well-resourced actors with cellular RF capabilities.