# CVE-2025-54328: Samsung Exynos stack buffer overflow in SMS RP-DATA parsing

Source: https://junglewise.ai/threats/cve-2025-54328-samsung-exynos-stack-buffer-overflow-in-sms-rp-data-parsing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-06. Updated: 2026-07-25  
License: CC BY 4.0 with a link back

CVE-2025-54328 · Severity: critical · CVSS 10 · Published 2026-04-06

A critical vulnerability has been identified in the cellular modem and processors used in many Samsung mobile and wearable devices. The flaw exists in how the device handles incoming text messages, potentially allowing a remote attacker to take control of the device or disrupt its operations simply by sending a malicious message. This could lead to the theft of sensitive data, unauthorized tracking, or a complete loss of device functionality.

## Quick answers

**Is CVE-2025-54328 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-54328 being exploited in the wild.

**How severe is CVE-2025-54328?** Critical severity, with a CVSS score of 10, published 6 April 2026.

**Which products and versions are affected?** Samsung Exynos 980; Samsung Exynos 990; Samsung Exynos 850; Samsung Exynos 1080; and 16 more.

**Is there a fix for CVE-2025-54328?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-54328 attacked?** It is attacked over the network, in device firmware.

**Am I affected by CVE-2025-54328?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stack-based buffer overflow (CWE-121) exists in the SMS implementation of several Samsung Exynos Mobile Processors, Wearable Processors, and Modems. The vulnerability is triggered during the parsing of SMS RP-DATA (Relay Protocol Data) messages. An unauthenticated remote attacker can exploit this by sending a specially crafted SMS message over the cellular network. Successful exploitation could lead to remote code execution within the modem or processor context, potentially bypassing security boundaries (S:C) and resulting in a total compromise of confidentiality, integrity, and availability. Affected chipsets include Exynos 980 through 2500, wearable series W920-W1000, and Modems 5123, 5300, and 5400.

## Affected products

- Samsung Exynos 980
- Samsung Exynos 990
- Samsung Exynos 850
- Samsung Exynos 1080
- Samsung Exynos 2100
- Samsung Exynos 1280
- Samsung Exynos 2200
- Samsung Exynos 1330
- Samsung Exynos 1380
- Samsung Exynos 1480
- Samsung Exynos 2400
- Samsung Exynos 1580
- Samsung Exynos 2500
- Samsung Exynos 9110
- Samsung Exynos W920
- Samsung Exynos W930
- Samsung Exynos W1000
- Samsung Exynos Modem 5123
- Samsung Exynos Modem 5300
- Samsung Exynos Modem 5400

## Timeline

- 2025-06-10: disclosed: Reported date according to vendor advisory
- 2026-04-06: advisory: Initial NVD publication date

## References

- [https://semiconductor.samsung.com/support/quality-support/product-security-updates/](https://semiconductor.samsung.com/support/quality-support/product-security-updates/)
- [https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-54328/](https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-54328/)