Samsung Exynos 980 Firmware: SMS Parser Stack Buffer Overflow (CVE-2025-54328)
A stack-based buffer overflow exists in the Samsung Exynos 980 firmware's SMS RP-DATA parser, enabling potential zero-click remote code execution on the baseband. A conceptual proof-of-concept (PoC) exploit has been published.
CVE search metadata
CVE search record: CVE-2025-54328. Severity: critical. CVSS: 10.0. EPSS: 0.52%. KEV: no. Product: Exynos 980 Firmware. Brief: Samsung Exynos 980 Firmware: SMS Parser Stack Buffer Overflow (CVE-2025-54328). Brief link: https://feed.craftedsignal.io/briefs/2026-10-samsung-exynos-sms-overflow/
Triage facts
Revision 1- Applicability
- Exynos 980 Firmware
- Evidence
- Unknown
- Severity
- Critical
- Sources
- 2 public sources
- Freshness
- Revision 1Oct 28, 19:23 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- C3Roughly even chance
CVE-2025-54328 is a stack-based buffer overflow in the SMS RP-DATA parser of Samsung Exynos 980 firmware. The vulnerability is reported as a zero-click, remote code execution (RCE) flaw affecting the baseband. A conceptual PoC has been published that generates a raw RP-DATA message with an oversized TPDU payload intended to trigger the overflow. The PoC documentation notes that successful exploitation requires target-specific memory layout and firmware gadget addresses.