Is CVE-2025-54328 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-54328 being exploited in the wild.

How severe is CVE-2025-54328?

Critical severity, with a CVSS score of 10, published 6 April 2026.

Which products and versions are affected?

Samsung Exynos 980; Samsung Exynos 990; Samsung Exynos 850; Samsung Exynos 1080; and 16 more.

Is there a fix for CVE-2025-54328?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-54328 attacked?

It is attacked over the network, in device firmware.

Am I affected by CVE-2025-54328?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-54328: Samsung Exynos stack buffer overflow in SMS RP-DATA parsing

CVE-2025-54328 · Severity: critical · CVSS 10 · Published 2026-04-06

A critical vulnerability has been identified in the cellular modem and processors used in many Samsung mobile and wearable devices. The flaw exists in how the device handles incoming text messages, potentially allowing a remote attacker to take control of the device or disrupt its operations simply by sending a malicious message. This could lead to the theft of sensitive data, unauthorized tracking, or a complete loss of device functionality.

Quick answers

Is CVE-2025-54328 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-54328 being exploited in the wild.
How severe is CVE-2025-54328?: Critical severity, with a CVSS score of 10, published 6 April 2026.
Which products and versions are affected?: Samsung Exynos 980; Samsung Exynos 990; Samsung Exynos 850; Samsung Exynos 1080; and 16 more.
Is there a fix for CVE-2025-54328?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-54328 attacked?: It is attacked over the network, in device firmware.
Am I affected by CVE-2025-54328?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stack-based buffer overflow (CWE-121) exists in the SMS implementation of several Samsung Exynos Mobile Processors, Wearable Processors, and Modems. The vulnerability is triggered during the parsing of SMS RP-DATA (Relay Protocol Data) messages. An unauthenticated remote attacker can exploit this by sending a specially crafted SMS message over the cellular network. Successful exploitation could lead to remote code execution within the modem or processor context, potentially bypassing security boundaries (S:C) and resulting in a total compromise of confidentiality, integrity, and availability. Affected chipsets include Exynos 980 through 2500, wearable series W920-W1000, and Modems 5123, 5300, and 5400.

Affected products

Samsung Exynos 980
Samsung Exynos 990
Samsung Exynos 850
Samsung Exynos 1080
Samsung Exynos 2100
Samsung Exynos 1280
Samsung Exynos 2200
Samsung Exynos 1330
Samsung Exynos 1380
Samsung Exynos 1480
Samsung Exynos 2400
Samsung Exynos 1580
Samsung Exynos 2500
Samsung Exynos 9110
Samsung Exynos W920
Samsung Exynos W930
Samsung Exynos W1000
Samsung Exynos Modem 5123
Samsung Exynos Modem 5300
Samsung Exynos Modem 5400

Timeline

2025-06-10: disclosed: Reported date according to vendor advisory
2026-04-06: advisory: Initial NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.