Is CVE-2025-54602 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-54602 being exploited in the wild.

How severe is CVE-2025-54602?

High severity, with a CVSS score of 7, published 6 April 2026.

Which products and versions are affected?

Samsung Exynos 980; Samsung Exynos 850; Samsung Exynos 1080; Samsung Exynos 1280; and 7 more.

Is there a fix for CVE-2025-54602?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-54602 attacked?

It is attacked with local access, in device firmware.

Am I affected by CVE-2025-54602?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-54602: Samsung Exynos Wi-Fi driver use-after-free via race condition

CVE-2025-54602 · Severity: high · CVSS 7 · Published 2026-04-06

A security vulnerability has been identified in the Wi-Fi software driver used by several Samsung Exynos mobile and wearable processors. This flaw could allow a malicious application installed on a device to cause system instability or potentially gain unauthorized access to sensitive data. The issue affects a wide range of Samsung smartphones and smartwatches using these specific chips.

Quick answers

Is CVE-2025-54602 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-54602 being exploited in the wild.
How severe is CVE-2025-54602?: High severity, with a CVSS score of 7, published 6 April 2026.
Which products and versions are affected?: Samsung Exynos 980; Samsung Exynos 850; Samsung Exynos 1080; Samsung Exynos 1280; and 7 more.
Is there a fix for CVE-2025-54602?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-54602 attacked?: It is attacked with local access, in device firmware.
Am I affected by CVE-2025-54602?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A use-after-free (UAF) vulnerability exists in the Wi-Fi driver of multiple Samsung Exynos chipsets (980, 850, 1080, 1280, 1330, 1380, 1480, 1580, W920, W930, and W1000). The root cause is improper synchronization (CWE-362) when accessing a global variable, which allows an attacker to trigger a race condition. By concurrently invoking an ioctl function from multiple threads, a local attacker with low privileges can cause memory corruption. This can lead to local privilege escalation or a complete system crash (denial of service).

Affected products

Samsung Exynos 980
Samsung Exynos 850
Samsung Exynos 1080
Samsung Exynos 1280
Samsung Exynos 1330
Samsung Exynos 1380
Samsung Exynos 1480
Samsung Exynos 1580
Samsung Exynos W920
Samsung Exynos W930
Samsung Exynos W1000

Timeline

2025-05-20: disclosed: Reported date according to vendor advisory
2026-04-06: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.