CVE-2026-48175Medium· 5.5▾ SunlitProcessing a malformed RRC message leads to an out-of-bounds read, resulting in a denial-of-service condition.
▾ Sunlit zone — Low / medium · no exploitation signal
impact 30.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the CISA ADP record, not NVD.
Processing a malformed RRC message leads to an out-of-bounds read, resulting in a denial-of-service condition.
exynos_1280 < September 2026exynos_1330 < September 2026exynos_1380 < September 2026exynos_1480 < September 2026exynos_2400 < September 2026exynos_1580 < September 2026exynos_2500 < September 2026exynos_modem_5123 < September 2026exynos_modem_5300 < September 2026exynos_modem_5400 < September 2026exynos_modem_5410 < September 2026Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-35494NoneIn the baseband, memory corruption during NAS packet processing can cause a denial of service.
CVE-2026-48174NoneIn the NR RRC component, improper handling of messages before authentication triggers a data abort, which leads to a denial‑of‑service condition.
CVE-2026-48186NoneImproper handling of messages before AS security activation can cause unexpected behavior
CVE-2026-68985NoneIn the Samsung Exynos NPU driver, improper validation of user input in the ioctl handler can lead to an out-of-bounds write, which causes a denial of service.
CVE-2025-66366NoneIncorrect handling of unauthenticated downlink RRC Setup messages can cause the baseband to crash
CVE-2026-48173NoneIn the NAS message handler, improper validation of the length field in NAS message causes memory corruption