| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Continuously sending control‑plane messages causes the baseband to crashes. |
| In the NAS Authentication Request message decoding procedure, a missing lower bound check causes an infinite loop, leading to Denial of Service. |
| In the LTE RRC component, improper handling of messages before authentication triggers a data abort, which leads to a denial‑of‑service condition. |
| Processing a malformed RRC Reconfiguration message leads to an out-of-bounds (OOB) access, resulting in a denial-of-service (DoS) condition. |
| Improper handling of NAS DLTransport messages may lead to a baseband crash. |
| Incorrect handling of unauthenticated downlink RRC Setup messages can cause the baseband to crash |
| In the Samsung GPU driver, improper reference count handling during command submission can lead to memory corruption. |
| In the Samsung Exynos GPU driver, improper synchronization during buffer object creation and closing can lead to memory corruption |
| Out-of-bounds memory access in a device driver due to improper resource state tracking. |
| Memory corruption in GPU driver due to improper validation of VMID reservation. |
| Incorrect authorization in Samsung framework services due to missing permission checks |
| In the Samsung Exynos H-Arx DRM plugin, improper input validation during buffer operations can cause memory corruption, potentially leading to denial of service or privilege escalation. |
| Insufficient validation of length fields in the GNSS firmware loader can result in kernel‑memory corruption. |
| Integer overflow in NPU driver parameter processing due to insufficient bounds checking. |
| In the Samsung Exynos NPU kernel driver, an integer overflow allows an unprivileged application to trigger memory corruption. |
| Improper permission handling during buffer operations allows untrusted applications to create memory mappings with inappropriate permissions |
| A double free vulnerability in NPU driver due to improper pointer management (941) |
| Improper handling of messages before AS security activation can cause unexpected behavior |
| Out of bound access in PPC due to race condition in global variable access |
| Processing a malformed RRC message leads to an out-of-bounds read, resulting in a denial-of-service condition. |
