CVE-2025-54328

CRITICAL

Samsung Exynos SMS RP-DATA Stack-Based Buffer Overflow

Generated titleSource: EIP title enrichment
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2025-54328 has a selected CVSS score of 10.0 (critical); EIP currently links 1 repository PoC.

Description

An issue was discovered in SMS in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 2500, 9110, W920, W930, W1000, Modem 5123, Modem 5300, and Modem 5400. A Stack-based Buffer Overflow occurs while parsing SMS RP-DATA messages.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 6, 2026 · Source: CVE List

Proofs of concept

1

Repository PoCs

GitHubHunt-Benito/samsung-exynos-sms-stack-overflow-cve-2025-54328-critical-zero-click-baseband-rceRepository PoCby Hunt-Benito1Exploit2 files

4.7 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Generates a malicious SMS RP-DATA message with an oversized TPDU payload designed to overflow a stack buffer in Samsung Exynos baseband firmware.

Backdoor review

No backdoor observed in reviewed code

The PoC consists of a README and a Python script that generates a malformed SMS RP-DATA message to trigger a stack buffer overflow. The script constructs a standard RP-DATA structure with an oversized TPDU payload and writes it to a file. No backdoor, deceptive payload, or concealed harmful behavior is present. The code is straightforward and does not perform any network communication, file exfiltration, persistence, or execution of external commands.

ClassificationExploit
Model confidence95%
AuthenticationNot required
LanguagesPython
Target softwareSamsung Exynos baseband firmware
Attack typesStack-based Buffer Overflow
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The Python script's primary purpose is to generate a payload that triggers a stack-based buffer overflow, which is the definition of exploit code. The README explicitly states it 'Generates a raw RP-DATA message... that would trigger a stack-based buffer overflow'.

README.md:15poc_cve_2025_54328.py:6-8

Requirements

  • Requires a method to inject the generated RP-DATA message into the target baseband, such as a fake BTS with SDR, an SMS gateway with raw PDU mode, or direct memory injection via JTAG/UART.README.md:25-28poc_cve_2025_54328.py:107-110

Observed behavior

  • Constructs an RP-DATA message with a 200-byte 'A' pattern in the TP-UD field, exceeding the expected buffer size to overwrite the stack.poc_cve_2025_54328.py:54-57
  • Saves the crafted malicious message to a binary file for later injection.poc_cve_2025_54328.py:102-105
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

File Write
cve-2025-54328-poc-rpdata.binThe script writes the generated malicious RP-DATA message to a local file for later injection. This is expected behavior for a PoC that generates a payload.poc_cve_2025_54328.py:102-104
Command Line Argument
target phone numberThe script accepts an optional target phone number as a command-line argument, which is used to construct the destination address in the RP-DATA message. This is a standard parameter for a PoC of this type.poc_cve_2025_54328.py:73-76
Review boundaries

What the analysis did not establish

  • The artifact is self-described as a 'conceptual PoC' and will not exploit a production device without specific memory layout and firmware gadget addresses for the target baseband version.
  • The generated payload is a simple pattern of 'A' characters and does not include a crafted return address or shellcode.
  • The review is limited to the supplied text files; no binary files were present or analyzed.
  • The PoC is conceptual and does not include the actual exploit delivery mechanism, which would require external hardware or software not provided in this artifact.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

3