CVE-2026-33970

NULL Pointer Dereference in 5G Baseband RRC Reconfiguration Handling

View on CVE.org
Published Sep 14, 2026 CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Description
An issue was discovered in NR RRC and L2 in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 2500, 1680, W920, W930, W1000, and Modem 5410. In the 5G baseband, a NULL Pointer Dereference occurs when processing a malformed RRC Reconfiguration message.

Analysis

AI-generated

Technical impact

An issue has been discovered in the 5G baseband NR RRC layer of Samsung Exynos firmware. A malformed RRC Reconfiguration message triggers a NULL Pointer Dereference during processing, classified as CWE‑476. The fault causes the baseband to crash, resetting or rebooting the device, which results in a denial of service for the user. No evidence of code execution or data exfiltration is present.

Affected Systems

The flaw affects Samsung firmware variants including Exynos 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 2500, 1680, wearable processors W920, W930, W1000, and Modem 5410. Any device running these basebands is considered vulnerable.

Risk and Exploitability

With a CVSS score of 3.5 the severity is low, and the EPSS score is below 1 %, indicating a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker would likely need to send a crafted RRC Reconfiguration packet over the cellular link or through a development interface to the baseband, requiring no special privileges on the device.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Download and install the latest Exynos firmware from Samsung’s official support site.
  • If possible, disable any development tools or APIs that allow the creation and injection of custom RRC messages to the baseband.
  • Until an updated firmware is available, isolate the delivery of malicious RRC packets, and monitor for unexpected reboots or crashes.

Generated by OpenCVE AI on September 15, 2026 at 15:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Title NULL Pointer Dereference in 5G Baseband RRC Reconfiguration Handling
Type Values Removed Values Added
Title Null Pointer Dereference in 5G Baseband NR RRC Reconfiguration on Samsung Exynos 850 Firmware
Type Values Removed Values Added
Title Null Pointer Dereference in 5G Baseband NR RRC Reconfiguration on Samsung Exynos 850 Firmware
Type Values Removed Values Added
Description An issue was discovered in NR RRC and L2 in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 2500, 1680, W920, W930, W1000, and Modem 5410. In the 5G baseband, a NULL Pointer Dereference occurs when processing a malformed RRC Reconfiguration message.
First Time appeared Samsung
Samsung exynos 850 Firmware
Weaknesses CWE-476
CPEs cpe:2.3:a:samsung:exynos_850_firmware:*:*:*:*:*:*:*:*
Vendors & Products Samsung
Samsung exynos 850 Firmware
References
Metrics cvssV3_1

{'score': 3.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L'}
Weaknesses

Sources

Status
PUBLISHED
Assigner
mitre
Published
Updated
Sep 16, 2026, 2:29 PM
Reserved
Mar 24, 2026, 12:00 AM

View source JSON

Updated
Sep 16, 2026, 2:29 PM

JSON

Status
Awaiting Analysis
Published
Sep 14, 2026, 3:16 AM
Modified
Sep 22, 2026, 7:56 PM

View source JSON

No data.

Updated
Sep 15, 2026, 4:00 PM

JSON