Is CVE-2025-58349 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-58349 being exploited in the wild.

How severe is CVE-2025-58349?

Critical severity, with a CVSS score of 9.1, published 6 April 2026.

Which products and versions are affected?

Samsung Exynos 980; Samsung Exynos 990; Samsung Exynos 850; Samsung Exynos 1080; and 16 more.

Is there a fix for CVE-2025-58349?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-58349 attacked?

It is attacked over the network, in device firmware.

Am I affected by CVE-2025-58349?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-58349: Samsung Exynos Modem denial of service in L2 component

CVE-2025-58349 · Severity: critical · CVSS 9.1 · Published 2026-04-06

A vulnerability has been identified in the cellular modem components of various Samsung Exynos processors used in mobile phones and wearable devices. An attacker could remotely send specially crafted cellular network packets to cause the device's modem to crash. This results in a loss of cellular connectivity and potentially impacts the overall stability of the device.

Quick answers

Is CVE-2025-58349 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-58349 being exploited in the wild.
How severe is CVE-2025-58349?: Critical severity, with a CVSS score of 9.1, published 6 April 2026.
Which products and versions are affected?: Samsung Exynos 980; Samsung Exynos 990; Samsung Exynos 850; Samsung Exynos 1080; and 16 more.
Is there a fix for CVE-2025-58349?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-58349 attacked?: It is attacked over the network, in device firmware.
Am I affected by CVE-2025-58349?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in the Layer 2 (L2) processing component of several Samsung Exynos mobile and wearable processors, as well as standalone modems. The issue stems from the incorrect handling of LTE MAC packets that contain an excessive number of MAC Control Elements (CEs), leading to uncontrolled resource consumption or a logic error that triggers a baseband crash. This is a network-based attack that requires no user interaction or prior authentication. Successful exploitation results in a denial-of-service (DoS) condition for the cellular modem, and according to CISA-ADP scoring, may also have implications for data confidentiality.

Affected products

Samsung Exynos 980
Samsung Exynos 990
Samsung Exynos 850
Samsung Exynos 1080
Samsung Exynos 2100
Samsung Exynos 1280
Samsung Exynos 2200
Samsung Exynos 1330
Samsung Exynos 1380
Samsung Exynos 1480
Samsung Exynos 2400
Samsung Exynos 1580
Samsung Exynos 2500
Samsung Exynos 9110
Samsung Exynos W920
Samsung Exynos W930
Samsung Exynos W1000
Samsung Modem 5123
Samsung Modem 5300
Samsung Modem 5400

Timeline

2025-07-21: other: Reported date according to vendor advisory
2026-04-06: disclosed: Initial publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.