Introduction
Remote heap overflows in baseband processors have historically let attackers compromise devices at the cellular protocol level and bypass OS-level defenses. CVE-2025-54329 affects a wide range of Samsung Exynos mobile processors, wearable chipsets, and modems. Malformed NAS messages can potentially corrupt memory on millions of these devices. The flaw is significant because it sits in the Non-Access Stratum (NAS) layer, which handles critical signaling and SMS delivery in LTE and 5G networks.
About Samsung Exynos and NAS: Samsung is one of the world's largest semiconductor manufacturers, and its Exynos line powers flagship smartphones, wearables, and network equipment around the world. The NAS protocol stack is a foundational part of mobile communications. It handles signaling and SMS outside the IP stack, so a vulnerability in this layer can reach far across both consumer and enterprise devices.
Technical Information
CVE-2025-54329 is a heap-based buffer overflow in the NAS function that sends multiple payload messages, including SMS. When a NAS message is built with multiple payloads, the function does not check that the total size of all payloads fits within the allocated heap buffer. An attacker who can send crafted NAS messages (for example, through a compromised or rogue base station) can trigger a heap overflow by specifying excessive payload sizes or counts.
The root cause is improper validation of input parameters and miscalculation of buffer boundaries during message segmentation and reassembly. The vulnerable code is present in the NAS implementation of the following Exynos and modem models:
- Exynos 980
- Exynos 990
- Exynos 850
- Exynos 2100
- Exynos 1280
- Exynos 2200
- Exynos 1330
- Exynos 1380
- Exynos 1480
- Exynos 2400
- Exynos 1580
- Exynos 2500
- Exynos W920
- Exynos W930
- Exynos W1000
- Modem 5123
- Modem 5300
- Modem 5400
No public code snippets of the vulnerable function are available. The vulnerability is classified as CWE-122 (Heap-based Buffer Overflow).
Patch Information
Samsung's patch adds strict bounds checking to the function that sends multiple payload messages, including SMS. The function now verifies the size of each payload before processing it, which prevents the buffer overflows that could lead to memory corruption.
The core of the patch is a conditional check that compares the payload size against the allocated buffer size. If the payload exceeds the permitted limit, the function returns an error and halts processing, which protects the system from potential exploitation through this path.
Samsung has not disclosed the exact code changes, which are proprietary. The general approach looks like this:
// Pseudo-code representation of the patch if (payload_size > MAX_PAYLOAD_SIZE) { return ERROR_CODE; } // Proceed with processing the payload
Because every payload must fall within the acceptable size range before processing starts, the check reduces the risk of heap overflow attacks and improves the security and stability of the affected components.
Samsung's security update page has the official statements and full patch details: https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-54329/
Affected Systems and Versions
CVE-2025-54329 affects the following Samsung Exynos processors and modems:
- Exynos 980
- Exynos 990
- Exynos 850
- Exynos 2100
- Exynos 1280
- Exynos 2200
- Exynos 1330
- Exynos 1380
- Exynos 1480
- Exynos 2400
- Exynos 1580
- Exynos 2500
- Exynos W920
- Exynos W930
- Exynos W1000
- Modem 5123
- Modem 5300
- Modem 5400
All firmware versions for these models before the November 2025 security update are vulnerable. Devices running the November 2025 security update or later are not affected.
Vendor Security History
Samsung Exynos processors have been hit by similar heap overflow vulnerabilities in their NAS and baseband protocol implementations before. Examples include CVE-2023-21517 (heap buffer overflow in LTE ESM) and vulnerabilities in the LLC and RLC layers disclosed in 2023. Samsung typically issues monthly security updates and coordinates advisories through its semiconductor security portal. The company has improved its patch response times in recent years, but the range of affected products can mean staggered update rollouts.
