The vulnerability results from an improper handling of the NL80211 vendor command in the Wi‑Fi driver on Samsung Exynos processors, creating a buffer overflow when a specific ioctl message is received. This buffer overflow can overwrite critical driver memory and allows an attacker to execute arbitrary code, potentially taking full control of the device’s operating system.

Affected models include Exynos 850, 980, 1280, 1330, 1380, 1480, 1580, W920, W930, and W1000. The issue exists in the default firmware provided by Samsung for these chips. Updated firmware releases from Samsung are expected to patch the flaw; devices running earlier firmware versions are vulnerable.

With a CVSS score of 9.8 the vulnerability is considered high‑severity, and the EPSS score of less than 1% indicates a low likelihood of exploitation at present. The flaw has not appeared in the CISA KEV catalog. The attack requires sending a crafted ioctl command to the Wi‑Fi driver, implying local or elevated privileges on the device are needed for exploitation. The potential impact is total ownership of the affected device.