CVE-2025-52909

Buffer Overflow in Wi‑Fi Driver via NL80211 Vendor Command on Samsung Exynos Processors

View on CVE.org
Published Apr 7, 2026 CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Description
An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1280, 1330, 1380, 1480, 1580, W920, W930, and W1000. Incorrect Handling of the NL80211 vendor command leads to a buffer overflow via a certain ioctl message, issue 2 of 2.

Analysis

AI-generated

Technical impact

The vulnerability results from an improper handling of the NL80211 vendor command in the Wi‑Fi driver on Samsung Exynos processors, creating a buffer overflow when a specific ioctl message is received. This buffer overflow can overwrite critical driver memory and allows an attacker to execute arbitrary code, potentially taking full control of the device’s operating system.

Affected Systems

Affected models include Exynos 850, 980, 1280, 1330, 1380, 1480, 1580, W920, W930, and W1000. The issue exists in the default firmware provided by Samsung for these chips. Updated firmware releases from Samsung are expected to patch the flaw; devices running earlier firmware versions are vulnerable.

Risk and Exploitability

With a CVSS score of 9.8 the vulnerability is considered high‑severity, and the EPSS score of less than 1% indicates a low likelihood of exploitation at present. The flaw has not appeared in the CISA KEV catalog. The attack requires sending a crafted ioctl command to the Wi‑Fi driver, implying local or elevated privileges on the device are needed for exploitation. The potential impact is total ownership of the affected device.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Samsung firmware release that addresses this issue for all vulnerable Exynos processors.
  • Confirm the firmware version after updating to ensure the NL80211 vendor command handling has been fixed.
  • If the device cannot receive a firmware update immediately, disable its Wi‑Fi functionality or isolate it from external networks until the patch is applied.
  • Monitor Samsung’s security advisories for any updates or additional workarounds.

Generated by OpenCVE AI on April 13, 2026 at 19:10 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Title Buffer Overflow in Wi‑Fi Driver via NL80211 Vendor Command on Samsung Exynos Processors
Type Values Removed Values Added
First Time appeared Samsung exynos 1280
Samsung exynos 1280 Firmware
Samsung exynos 1330
Samsung exynos 1330 Firmware
Samsung exynos 1380
Samsung exynos 1380 Firmware
Samsung exynos 1480
Samsung exynos 1480 Firmware
Samsung exynos 1580
Samsung exynos 1580 Firmware
Samsung exynos 850
Samsung exynos 850 Firmware
Samsung exynos 980
Samsung exynos 980 Firmware
Samsung exynos W1000
Samsung exynos W1000 Firmware
Samsung exynos W920
Samsung exynos W920 Firmware
Samsung exynos W930
Samsung exynos W930 Firmware
CPEs cpe:2.3:h:samsung:exynos_1280:-:*:*:*:*:*:*:*
cpe:2.3:h:samsung:exynos_1330:-:*:*:*:*:*:*:*
cpe:2.3:h:samsung:exynos_1380:-:*:*:*:*:*:*:*
cpe:2.3:h:samsung:exynos_1480:-:*:*:*:*:*:*:*
cpe:2.3:h:samsung:exynos_1580:-:*:*:*:*:*:*:*
cpe:2.3:h:samsung:exynos_850:-:*:*:*:*:*:*:*
cpe:2.3:h:samsung:exynos_980:-:*:*:*:*:*:*:*
cpe:2.3:h:samsung:exynos_w1000:-:*:*:*:*:*:*:*
cpe:2.3:h:samsung:exynos_w920:-:*:*:*:*:*:*:*
cpe:2.3:h:samsung:exynos_w930:-:*:*:*:*:*:*:*
cpe:2.3:o:samsung:exynos_1280_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:samsung:exynos_1330_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:samsung:exynos_1380_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:samsung:exynos_1480_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:samsung:exynos_1580_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:samsung:exynos_850_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:samsung:exynos_980_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:samsung:exynos_w1000_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:samsung:exynos_w920_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:samsung:exynos_w930_firmware:-:*:*:*:*:*:*:*
Vendors & Products Samsung exynos 1280
Samsung exynos 1280 Firmware
Samsung exynos 1330
Samsung exynos 1330 Firmware
Samsung exynos 1380
Samsung exynos 1380 Firmware
Samsung exynos 1480
Samsung exynos 1480 Firmware
Samsung exynos 1580
Samsung exynos 1580 Firmware
Samsung exynos 850
Samsung exynos 850 Firmware
Samsung exynos 980
Samsung exynos 980 Firmware
Samsung exynos W1000
Samsung exynos W1000 Firmware
Samsung exynos W920
Samsung exynos W920 Firmware
Samsung exynos W930
Samsung exynos W930 Firmware
Type Values Removed Values Added
Title Buffer Overflow in Samsung Exynos Wi‑Fi Driver via NL80211 Vendor Command
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Title Buffer Overflow in Samsung Exynos Wi‑Fi Driver via NL80211 Vendor Command
First Time appeared Samsung
Samsung exynos
Weaknesses CWE-120
Vendors & Products Samsung
Samsung exynos
Type Values Removed Values Added
Description An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1280, 1330, 1380, 1480, 1580, W920, W930, and W1000. Incorrect Handling of the NL80211 vendor command leads to a buffer overflow via a certain ioctl message, issue 2 of 2.
References
Earlier changes (1)
Weaknesses
  • CWE-120

    Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Sources

Status
PUBLISHED
Assigner
mitre
Published
Updated
Apr 9, 2026, 1:42 PM
Reserved
Jun 21, 2025, 12:00 AM

View source JSON

Updated
Apr 9, 2026, 1:42 PM

JSON

Status
Analyzed
Published
Apr 7, 2026, 3:17 PM
Modified
Nov 4, 2026, 10:10 PM

View source JSON

No data.

Updated
Apr 14, 2026, 4:41 PM

JSON