CVE-2026-48173None▾ SunlitIn the NAS message handler, improper validation of the length field in NAS message causes memory corruption
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
In the NAS message handler, improper validation of the length field in NAS message causes memory corruption
exynos_850 < September 2026exynos_2100 < September 2026exynos_1280 < September 2026exynos_2200 < September 2026exynos_1330 < September 2026exynos_1380 < September 2026exynos_1480 < September 2026exynos_2400 < September 2026exynos_1580 < September 2026exynos_2500 < September 2026exynos_1680 < September 2026exynos_9110 < September 2026exynos_w920 < September 2026exynos_w930 < September 2026exynos_w1000 < September 2026exynos_modem_5123 < September 2026exynos_modem_5300 < September 2026exynos_modem_5400 < September 2026exynos_modem_5410 < September 2026Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-69006NoneInsufficient validation of length fields in the GNSS firmware loader can result in kernel‑memory corruption.
CVE-2025-66367NoneImproper handling of NAS DLTransport messages may lead to a baseband crash.
CVE-2026-33969NoneIn the NAS Authentication Request message decoding procedure, a missing lower bound check causes an infinite loop, leading to Denial of Service.
CVE-2026-33971NoneIn the LTE RRC component, improper handling of messages before authentication triggers a data abort, which leads to a denial‑of‑service condition.
CVE-2025-66364NoneContinuously sending control‑plane messages causes the baseband to crashes.
CVE-2026-48175Medium· 5.5Processing a malformed RRC message leads to an out-of-bounds read, resulting in a denial-of-service condition.