Improper memory initialization in Samsung’s RRC module causes an illegal memory access when a malformed RRCReconfiguration message is processed. The resulting memory fault throws the platform into an unrecoverable state, leading to an operating‑system or firmware crash. This vulnerability matches the input validation weakness represented by CWE‑20 and does not provide a direct path to arbitrary code execution.

The flaw is present in a wide range of Samsung Exynos processor families, including mobile, wearable, and modem chipsets such as Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 2500, 9110, W920, W930, W1000, and modem variants 5123, 5300, 5400. All associated firmware versions listed in the vendor’s security updates are potentially affected.

The CVSS base score of 7.5 indicates a high severity rating, yet the EPSS score is below 1 %, implying a low probability of exploitation in the wild. The vulnerability is not currently listed in CISA’s KEV catalog. Attackers would need to send a crafted RRCReconfiguration message to a device using the affected chipset, which typically requires proximity to the radio interface or privileged access to the host system. The impact is confined to denial of service—a system crash—rather than privilege escalation or data leakage.