CVE-2025-57835
Improper Memory Initialization in Samsung Exynos RRC Causes Crash
Publication date: 2026-04-06
Last updated on: 2026-04-07
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| samsung | exynos_990_firmware | * |
| samsung | exynos_980_firmware | * |
| samsung | exynos_850_firmware | * |
| samsung | exynos_1080_firmware | * |
| samsung | exynos_1280_firmware | * |
| samsung | exynos_1330_firmware | * |
| samsung | exynos_1380_firmware | * |
| samsung | exynos_1480_firmware | * |
| samsung | exynos_1580_firmware | * |
| samsung | exynos_2100_firmware | * |
| samsung | exynos_2200_firmware | * |
| samsung | exynos_2400_firmware | * |
| samsung | exynos_2500_firmware | * |
| samsung | exynos_w930_firmware | * |
| samsung | exynos_w920_firmware | * |
| samsung | exynos_w1000_firmware | * |
| samsung | exynos_modem_5400_firmware | * |
| samsung | exynos_modem_5300_firmware | * |
| samsung | exynos_modem_5123_firmware | * |
| samsung | exynos_9110_firmware | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-20 | The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-57835 is a medium-severity vulnerability found in multiple Samsung Exynos processors and modems. It occurs due to improper memory initialization in the Radio Resource Control (RRC) component, which causes illegal memory access. This illegal access can lead to a system crash when a malformed RRCReconfiguration message is processed.
How can this vulnerability impact me? :
This vulnerability can cause affected Samsung devices using the listed Exynos processors or modems to crash unexpectedly. Such system crashes can disrupt normal device operation, potentially leading to loss of data or service interruptions.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify any impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.