CVE-2025-26785: Buffer Overflow
An issue was discovered in NAS in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, W920, W930, W1000, Modem 5123, Modem 5300, Modem 5400. The lack of a length check leads to out-of-bounds writes.
Other sources
In MMMMNRMMDLNASTRANSPORTINDHandler of cnNrmmIntHdlr.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
— OSV
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
android/:unknown:to a version that resolves this vulnerability.Fixed in Pixel-family specific:2025-06-05
Event History
Frequently Asked Questions
What is the severity of CVE-2025-26785?
CVE-2025-26785 has been assessed with a critical severity due to potential out-of-bounds writes.
How do I fix CVE-2025-26785?
To fix CVE-2025-26785, users should update their devices to the latest available firmware from Samsung.
Which devices are affected by CVE-2025-26785?
CVE-2025-26785 affects various Samsung Exynos, Wearable, and Modem processors including Exynos 9820, 9825, and several others.
What type of vulnerability is CVE-2025-26785?
CVE-2025-26785 is an out-of-bounds write vulnerability that can lead to potential exploitation.
Is there a workaround for CVE-2025-26785?
There is currently no known workaround for CVE-2025-26785 aside from applying the recommended firmware updates.