Samsung Exynos Processor Vulnerability: CVE-2025-62817
A security vulnerability, designated CVE-2025-62817, has been identified in several Samsung Exynos processors. This vulnerability could lead to a denial-of-service (DoS) condition. The issue affects a wide range of Exynos chips and was publicly disclosed in early March 2026.
Vulnerability Details
The vulnerability is a null pointer dereference within the __pilot_parsing_ncp() function, specifically related to session->ncp_hdr_buf. A null pointer dereference occurs when a program attempts to access a memory location that has not been assigned a valid address, leading to unpredictable behavior and often a crash. In this case, it results in a denial of service, rendering the affected device unusable.
Affected Products
The following Samsung Exynos processors are affected by CVE-2025-62817:
- Exynos 1280
- Exynos 2200
- Exynos 1380
- Exynos 1480
- Exynos 2400
- Exynos 1580
- Exynos 2500
Severity and Impact
The vulnerability is rated as Medium severity by Samsung Semiconductor (Samsung Security Update). The National Vulnerability Database (NVD) currently assigns a CVSS v3 score of 7.5 (High) with a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (NVD Details). This indicates that the vulnerability is remotely exploitable, requires low attack complexity, and has high impact on availability.
Mitigation
Samsung Semiconductor has released patches to address this vulnerability. Device manufacturers are responsible for incorporating these patches into their software updates. Users are advised to ensure their devices are running the latest available software to protect against this vulnerability.
Technical Details
The vulnerability is categorized as CWE-476: NULL Pointer Dereference (NVD CWE Details). This means the issue stems from the improper handling of null pointers within the affected code.
Timeline
The vulnerability was reported on September 29, 2025, and Samsung acknowledged the issue. Details were publicly disclosed on March 2, 2026, and the NVD published its analysis on March 3, 2026.