{"id":"CVE-2025-22377","aliases":["A-383333278","EUVD-2025-16422","GHSA-4v6j-536v-64fw","PUB-A-383333278"],"status":"published","title":"An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980,...","description":"An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 9110, W920, W930, W1000, Modem 5123, Modem 5300, Modem 5400. A Heap-based Out-of-Bounds Write exists in the GPRS protocol implementation because of a mismatch between the actual length of the payload and the length declared within the payload.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.0036,"percentile":0.30093,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2025-03-01T00:00:00Z","modified":"2026-11-05T16:32:28Z","fixes":[{"ecosystem":"Android","package":":unknown:","fixed_in":["Pixel-family specific:2025-03-05"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Android","package":":unknown:","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"Pixel-family specific:0"},{"fixed":"Pixel-family specific:2025-03-05"}]}],"versions":["Pixel-family specific"]}],"products":[{"vendor":"samsung","product":"exynos_1080_firmware"},{"vendor":"samsung","product":"exynos_1280_firmware"},{"vendor":"samsung","product":"exynos_1330_firmware"},{"vendor":"samsung","product":"exynos_1380_firmware"},{"vendor":"samsung","product":"exynos_1480_firmware"},{"vendor":"samsung","product":"exynos_2100_firmware"},{"vendor":"samsung","product":"exynos_2200_firmware"},{"vendor":"samsung","product":"exynos_2400_firmware"},{"vendor":"samsung","product":"exynos_850_firmware"},{"vendor":"samsung","product":"exynos_9110_firmware"},{"vendor":"samsung","product":"exynos_980_firmware"},{"vendor":"samsung","product":"exynos_990_firmware"},{"vendor":"samsung","product":"exynos_modem_5123_firmware"},{"vendor":"samsung","product":"exynos_modem_5300_firmware"},{"vendor":"samsung","product":"exynos_modem_5400_firmware"},{"vendor":"samsung","product":"exynos_w1000_firmware"},{"vendor":"samsung","product":"exynos_w920_firmware"},{"vendor":"samsung","product":"exynos_w930_firmware"}],"references":[{"url":"https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-22377/","tags":["Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-22377"},{"url":"https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-22377"},{"url":"https://github.com/advisories/GHSA-4v6j-536v-64fw"},{"url":"https://source.android.com/security/bulletin/2025-03-01","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-22377","description":"An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 9110, W920, W930, W1000, Modem 5123, Modem 5300, Modem 5400. A Heap-based Out-of-Bounds Write exists in the GPRS protocol implementation because of a mismatch between the actual length of the payload and the length declared within the payload.","status":"published","published":"2025-05-27T00:00:00Z","modified":"2025-05-29T18:24:53.542Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:32:29.286772Z"}],"euvd":[{"id":"EUVD-2025-16422","description":"An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 9110, W920, W930, W1000, Modem 5123, Modem 5300, Modem 5400. A Heap-based Out-of-Bounds Write exists in the GPRS protocol implementation because of a mismatch between the actual length of the payload and the length declared within the payload.","status":"published","published":"2025-05-27T00:00:00Z","modified":"2025-05-29T18:24:53Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:32:34.937389Z"}],"ghsa":[{"id":"GHSA-4v6j-536v-64fw","title":"An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980,...","description":"An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 9110, W920, W930, W1000, Modem 5123, Modem 5300, Modem 5400. A Heap-based Out-of-Bounds Write exists in the GPRS protocol implementation because of a mismatch between the actual length of the payload and the length declared within the payload.","status":"published","published":"2025-05-27T18:30:51Z","modified":"2025-05-29T21:32:43Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T15:02:30.221111Z"}],"nvd":[{"id":"CVE-2025-22377","description":"An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 9110, W920, W930, W1000, Modem 5123, Modem 5300, Modem 5400. A Heap-based Out-of-Bounds Write exists in the GPRS protocol implementation because of a mismatch between the actual length of the payload and the length declared within the payload.","status":"published","published":"2025-05-27T17:15:25.463Z","modified":"2026-06-17T08:46:54.35Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:11:09.562272Z"}],"osv":[{"id":"PUB-A-383333278","description":"In mm_GetMobileIdIndexForNsUpdate of mm_GmmPduCodec.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","status":"published","published":"2025-03-01T00:00:00Z","modified":"2026-11-10T17:02:23.040266809Z","updated_at":"2026-11-10T17:35:08.76702Z"}]}}