CVE-2026-33970 in Exynos
Summary
by MITRE • 09/14/2026
An issue was discovered in NR RRC and L2 in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 2500, 1680, W920, W930, W1000, and Modem 5410. In the 5G baseband, a NULL Pointer Dereference occurs when processing a malformed RRC Reconfiguration message.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/14/2026
The vulnerability identified in Samsung Mobile Processors, including Wearable Processor and Modem Exynos series such as 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 2500, 1680, W920, W930, W1000, and Modem 5410, represents a critical flaw within the Radio Resource Control layer of the 5G baseband stack. This issue specifically manifests as a NULL Pointer Dereference when the device processes a malformed RRC Reconfiguration message sent by a network entity or an attacker-controlled radio interface. The Root Cause Analysis indicates that the protocol implementation fails to adequately validate input parameters before attempting to access memory structures associated with the configuration data, leading to a crash in the baseband processor firmware.
From a technical perspective, this vulnerability falls under CWE-476: NULL Pointer Dereference, which is categorized as an improper check for unusual or exceptional conditions during software execution. In the context of 5G NR RRC and Layer 2 protocols, the baseband modem must parse complex signaling messages to establish and maintain radio connections. When a malformed message containing invalid pointers or missing mandatory fields is received, the parsing logic attempts to dereference a memory address that has not been properly initialized or allocated. This results in an immediate fault within the real-time operating system of the modem, causing a service disruption or complete crash of the baseband processor functionality.
The operational impact of this vulnerability is significant for device availability and reliability. Since the flaw resides in the core protocol stack responsible for managing radio link configurations, triggering it can lead to a denial-of-service condition where the mobile device loses connectivity with the cellular network. In severe cases, repeated exploitation may cause persistent instability or require a hard reset of the modem firmware to restore functionality. For users relying on these devices for critical communications, particularly in wearable and IoT contexts where power efficiency and stable connections are paramount, this vulnerability poses a tangible risk to service continuity.
This type of memory safety error is often associated with CWE-20: Improper Input Validation, as the root cause lies in the failure to sanitize or verify the structure and content of incoming RRC messages before processing them within the L2 stack. Furthermore, from an adversarial perspective, this vulnerability aligns with ATT&CK techniques related to resource hijacking through denial-of-service attacks against network infrastructure components. An attacker positioned at a physical proximity level could craft specific malformed packets to exploit this flaw, effectively disrupting cellular service for devices equipped with the affected Samsung silicon.
Mitigation strategies primarily involve firmware updates provided by Samsung that address the input validation logic within the RRC and L2 processing modules. These patches ensure that all pointers derived from incoming messages are validated against expected bounds and memory allocations before dereferencing occurs. Additionally, implementing robust fuzzing tests during the development lifecycle for baseband protocol stacks can help identify similar edge cases where malformed inputs might lead to undefined behavior. Network operators should also consider deploying intrusion detection systems capable of identifying anomalous RRC signaling patterns that deviate from standard protocol specifications, providing an additional layer of defense against exploitation attempts targeting these hardware vulnerabilities.