Description

An issue was discovered in NR RRC and L2 in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 2500, 1680, W920, W930, W1000, and Modem 5410. In the 5G baseband, a NULL Pointer Dereference occurs when processing a malformed RRC Reconfiguration message.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.5",
  "pubDate": "2026-09-14T03:16:36.750Z",
  "pubdate": "2026-09-14T03:16:36.750Z",
  "executiveSummary": "A critical NULL Pointer Dereference vulnerability exists within the NR RRC (Radio Resource Control) and L2 layer of various Samsung Exynos mobile and wearable processors, as well as specific modem chipsets.\nThe vulnerability occurs during the processing of malformed RRC Reconfiguration messages within the 5G baseband stack.\nSuccessful exploitation allows an unauthenticated, remote attacker—typically via a malicious base station or over-the-air signaling—to trigger a system crash, resulting in a Denial of Service (DoS) of the cellular communication functionality.\nThe scope of the impact includes a wide array of Exynos chipsets, notably the 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 2500, 1680, W920, W930, W1000, and Modem 5410.\nBecause the vulnerability resides in the baseband processor, it is reachable via radio frequency (RF) signals, posing a significant risk to user availability and network connectivity without requiring physical access or user interaction.",
  "technicalDetails": "The vulnerability is identified as a NULL Pointer Dereference occurring within the 5G baseband communication stack, specifically within the NR RRC (New Radio Radio Resource Control) and L2 layers.\nThe root cause of the issue is an improper validation of input parameters during the parsing phase of an RRC Reconfiguration message. When the baseband firmware receives a maliciously crafted or malformed RRC Reconfiguration message, the parser fails to correctly verify the integrity or existence of expected pointers within the message structure.\nIn the event of receiving such a malformed packet, the internal state machine or parsing function attempts to access a memory address derived from an uninitialized or NULL pointer. Because the baseband environment typically lacks the memory protection mechanisms found in modern OS kernels, dereferencing this NULL pointer causes the processor to enter an undefined state, typically resulting in an immediate exception or kernel panic within the modem firmware.\nAttack Flow: 1. The attacker acts as a rogue base station or utilizes a compromised SDR (Software Defined Radio) to transmit a crafted RRC Reconfiguration message to the target mobile device over the 5G NR air interface. 2. The target device's modem identifies the message as an RRC signaling packet and passes it to the RRC layer for decoding. 3. The decoder attempts to process the fields of the malformed message, leading the execution flow to a routine that assumes valid data pointers. 4. Due to the lack of null-checking logic, the processor dereferences a null pointer, triggering a hardware exception. 5. The baseband processor resets or freezes to handle the fault, causing the modem to drop the connection and rendering the device unable to provide cellular services (DoS).\nAffected Components: The primary vulnerable component is the baseband firmware handling Layer 2 and RRC signaling protocols. Because this layer sits between the physical radio hardware and the application processor, it is exposed to any incoming signaling traffic from the network.\nExploitation requirements: The attacker must be within RF range of the target and capable of injecting RRC-layer signaling messages. Authentication is not required as the vulnerability is triggered during the standard signaling handshake process."
}