CVE-2026-33970

Awaiting Analysis Awaiting Analysis - Queue

NULL Pointer Dereference in Samsung Exynos Modem and Mobile Processors

Publication date: 2026-09-14

Last updated on: 2026-09-22

Assigner: MITRE

Description

An issue was discovered in NR RRC and L2 in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 2500, 1680, W920, W930, W1000, and Modem 5410. In the 5G baseband, a NULL Pointer Dereference occurs when processing a malformed RRC Reconfiguration message.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-14

Last Modified

2026-09-22

Generated

2026-11-08

AI Q&A

2026-09-14

EPSS Evaluated

2026-11-07

NVD

CVE-2026-33970

EUVD

EUVD-2026-77174

Affected Vendors & Products

Vendor	Product	Version / Range
samsung	exynos_850	*
samsung	exynos_1080	*
samsung	exynos_2100	*
samsung	exynos_1280	*
samsung	exynos_2200	*
samsung	exynos_1330	*
samsung	exynos_1380	*
samsung	exynos_1480	*
samsung	exynos_2400	*
samsung	exynos_1580	*
samsung	exynos_2500	*
samsung	exynos_1680	*
samsung	w920	*
samsung	w930	*
samsung	w1000	*
samsung	modem_5410	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-476	The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

Executive Summary

This is a NULL Pointer Dereference vulnerability in Samsung's 5G baseband processors. It occurs when the system tries to process a malformed Radio Resource Control (RRC) Reconfiguration message. This flaw affects multiple Exynos chipsets and modem models used in mobile and wearable devices.

Detection Guidance

Detection requires monitoring for malformed RRC Reconfiguration messages in 5G baseband traffic. Use network analyzers like Wireshark to inspect 5G control plane traffic for malformed RRC messages targeting Samsung Exynos chipsets. Check logs for NULL pointer dereference errors in NR RRC or L2 layers on affected devices.

Impact Analysis

The vulnerability could cause a denial of service (DoS) condition in affected devices. This means your device might crash or become unresponsive when processing a specific malformed network message. It does not directly expose data but may disrupt normal device functionality.

Compliance Impact

The provided text does not specify how CVE-2026-33970 affects compliance with standards like GDPR or HIPAA. The vulnerability is a NULL Pointer Dereference in Samsung's 5G baseband processors, which could lead to denial of service but does not directly indicate data breaches or privacy violations.

Mitigation Strategies

Apply security updates from Samsung if available. Isolate affected devices from critical network segments. Monitor for suspicious RRC message patterns. Contact Samsung support for patch availability as no fixes are mentioned in the provided text.

Hi! I’m here to help you understand CVE-2026-33970. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...