Vulnerabilities

In the baseband, memory corruption during NAS packet processing can cause a denial of service.

Out of bound access in PPC due to race condition in global variable access

Improper handling of messages before AS security activation can cause unexpected behavior

A double free vulnerability in NPU driver due to improper pointer management (940)

Improper permission handling during buffer operations allows untrusted applications to create memory mappings with inappropriate permissions

In the Samsung Exynos GPU driver, improper synchronization during buffer object creation and closing can lead to memory corruption

Processing a malformed RRC Reconfiguration message leads to an out-of-bounds (OOB) access, resulting in a denial-of-service (DoS) condition.

In the LTE RRC component, improper handling of messages before authentication triggers a data abort, which leads to a denial‑of‑service condition.

In the NAS Authentication Request message decoding procedure, a missing lower bound check causes an infinite loop, leading to Denial of Service.

Continuously sending control‑plane messages causes the baseband to crashes.