This vulnerability is an out‑of‑bounds write triggered by a mismatch between the TP‑UDHI and UDL values when parsing an SMS TP‑UD packet. The memory corruption can lead to arbitrary code execution, privilege escalation, or a device reboot, and because it occurs during SMS processing the effect is available to an attacker without physical access.

The flaw affects a broad range of Samsung Exynos mobile processors, wearable processors, and modem chips, including Exynos 980, 990, 850, 1080, 1280, 1330, 1380, 1480, 1580, 2100, 2200, 2400, 2500, 9110, W1000, W920, W930, and modem modules 5123, 5300, and 5400. All current releases of these chips are considered vulnerable until Samsung issues an update.

The CVSS score of 9.8 signals a critical security risk, while the EPSS of <1 % indicates that the likelihood of exploitation is low at present. Because the vulnerability is triggered by an SMS, the attack surface is remote via the network, and the lack of KEV listing means no public exploit has been reported. Nevertheless, operators should assume that a malicious SMS payload could trigger the overflow and take appropriate mitigations.