Introduction
When a smartphone or wearable loses cellular connectivity, emergency calls, business operations, and critical communications can go down with it. Samsung's October 2025 security update fixes a denial of service vulnerability in the Exynos chipset family that could be triggered remotely over the cellular network. The flaw affects millions of devices worldwide.
Samsung is one of the dominant companies in the global semiconductor and mobile device market. Its Exynos processors run a wide range of Galaxy smartphones, tablets, wearables, and standalone modems, in flagship and mid-range devices sold across Europe, Asia, and other regions. A vulnerability in this platform therefore has a large impact on consumers and enterprises alike.
Technical Information
CVE-2025-26781 comes from incorrect handling of Radio Link Control (RLC) Acknowledged Mode (AM) Protocol Data Units (PDUs) in the L2 layer of Samsung Exynos mobile, wearable, and modem chipsets. RLC AM handles reliable data transfer over cellular networks, with segmentation, reassembly, and error correction through ARQ mechanisms. The flaw in Samsung's implementation is classified under CWE-20 (Improper Input Validation) and CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer).
The root cause is that incoming RLC AM PDUs are not properly validated or bound-checked. When the Exynos baseband processor receives a malformed or specially crafted PDU over the cellular network, it may perform out-of-bounds memory operations or enter an invalid state. The result can be a denial of service: lost cellular connectivity, a modem crash, or a device reboot. The flaw sits in the L2 protocol stack, which processes network data before any higher-level operating system protection can intervene. An attacker does not need physical access to the device and may be able to exploit the flaw remotely over the air.
No code snippets or exploit code are publicly available for this vulnerability. Hoang Dinh Tuan of SysSec Lab KAIST discovered the issue and disclosed it responsibly.
Affected Systems and Versions
CVE-2025-26781 affects these Samsung Exynos chipsets:
- Exynos 9820
- Exynos 9825
- Exynos 980
- Exynos 990
- Exynos 850
- Exynos 1080
- Exynos 2100
- Exynos 1280
- Exynos 2200
- Exynos 1330
- Exynos 1380
- Exynos 1480
- Exynos 9110
- Exynos W920 (wearable)
- Exynos W930 (wearable)
- Exynos Modem 5123
- Exynos Modem 5300
Every device model that uses one of these chipsets is considered vulnerable on any firmware version released before the October 2025 security update. That covers smartphones, wearables, and standalone modems built on these Exynos components.
Vendor Security History
Samsung has a documented history of vulnerabilities in its Exynos baseband and protocol stack implementations. Several remote code execution and denial of service flaws in Exynos modem firmware have been disclosed in recent years. Samsung usually patches supported devices promptly, but updates for older or region-specific models may lag. The company runs a dedicated security advisory portal and has published detailed guidance for CVE-2025-26781 and related issues.
References
- Samsung CVE-2025-26781 Advisory
- Samsung Product Security Updates Portal
- NVD Entry for CVE-2025-26781
- iBeta: Samsung's October 2025 Security Patch
- HKCERT: Samsung Products Multiple Vulnerabilities
- 5G NR RLC AM Mode Data Transmission
- ShareTechnote: 5G RLC
- TASZK Labs: There Will Be Bugs
- TASZK Labs: Baseband
- SysSec Lab KAIST Members
- KAIST News: SysSec Lab Research
