Status: UPDATED | Advisory ID: CVE-2025-52908
| CVE | CVE-2025-52908 |
| CVSS Score / Version | 9.8 (Critical) / CVSS v3.1 |
| Updated | 2026-06-17 |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CVSS Prose | attack vector is network; attack complexity is low; privileges required is none; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high. |
| Affected products | see table below |
| Classified as | CWE-120 (Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')) |
| Vendor | Product | Affected Versions | Patch Status |
|---|---|---|---|
| Samsung | exynos_980_firmware | ||
| Samsung | exynos_850_firmware | ||
| Samsung | exynos_1280_firmware | ||
| Samsung | exynos_1330_firmware | ||
| Samsung | exynos_1380_firmware | ||
| Samsung | exynos_1480_firmware | ||
| Samsung | exynos_1580_firmware | ||
| Samsung | exynos_w930_firmware | ||
| Samsung | exynos_w920_firmware | ||
| Samsung | exynos_w1000_firmware |
| Subsystems | General OT |
| Sectors | Multiple |
An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1280, 1330, 1380, 1480, 1580, W920, W930, and W1000. Incorrect Handling of the NL80211 vendor command leads to a buffer overflow via a certain ioctl message, issue 1 of 2. (NVD)
Monitor Samsung's web page for any future patch releases. See vendor advisory link below.