A stack-based buffer overflow exists in the SMS parsing logic of Samsung Exynos mobile, wearable, and modem processors. The flaw occurs when handling SMS RP-DATA messages and may allow an attacker to inject crafted data that overflows a stack buffer, potentially leading to arbitrary code execution or privilege escalation on the device. The weakness aligns with CWE‑121 and can compromise system confidentiality, integrity, and availability if exploited.

The vulnerability affects Samsung Exynos processors and associated firmware across a broad range of models, including the 980, 990, 850, 1080, 1280, 1330, 1380, 1480, 1580, 2100, 2200, 2400, 2500, 9110, 1000, 920, 930, 5123, 5300, and 5400, as well as their mobile, wearable, and modem variants. Specific version information is not disclosed, but any device running the listed hardware platforms is potentially impacted.

The CVSS score of 10 indicates critical severity, while the EPSS score below 1% suggests a low probability of exploitation in the wild. Samsung has not reported this flaw in the CISA KEV catalog, implying no known public exploits. The most likely attack vector involves remote delivery of a malicious SMS containing specially crafted RP‑DATA content; therefore, an adversary can target devices without physical access.