CVE-2025-26781: Input Validation
An issue was discovered in L2 in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 9110, W920, W930, Modem 5123, and Modem 5300. Incorrect handling of RLC AM PDUs leads to a Denial of Service.
Other sources
In cellular modem, there is a possible buffer overflow due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
— OSV
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
android/:unknown:to a version that resolves this vulnerability.Fixed in Pixel-family specific:2025-12-05
Event History
Frequently Asked Questions
What is the severity of CVE-2025-26781?
CVE-2025-26781 has a severity rating that indicates a potential for Denial of Service due to incorrect handling of RLC AM PDUs.
How do I fix CVE-2025-26781?
To mitigate CVE-2025-26781, users should apply the latest firmware updates provided by Samsung for the affected processors and modems.
Which devices are affected by CVE-2025-26781?
CVE-2025-26781 affects several Samsung devices including the Exynos 980, 990, and various Samsung wearable and modem processors.
What type of vulnerability is CVE-2025-26781?
CVE-2025-26781 is classified as a Denial of Service vulnerability resulting from incorrect handling of protocol data units.
Is CVE-2025-26781 actively exploited in the wild?
As of now, there is no evidence suggesting that CVE-2025-26781 is actively exploited in the wild.