CVE-2025-66363

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An issue was discovered in LBS in Samsung Mobile Processor Exynos 2200. There was no check for memory initialization within DL NAS Transport messages.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-665

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Mar 3, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-663647.5Continuously sending control‑plane messages causes the baseband to crashes.CVE-2025-663655.3Incorrect handling of SIP packets leads to baseband crashesCVE-2025-663667.5Incorrect handling of unauthenticated downlink RRC Setup messages can cause the baseband to crashCVE-2025-663677.5Improper handling of NAS DLTransport messages may lead to a baseband crash.CVE-2025-663687.5Incorrect handling of SDP payload leads to a Denial of ServiceCVE-2025-663697.5An issue was discovered in MM in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 2100, 1280, 2200, 1330, 1380,CVE-2025-66377.8A maliciously crafted PRT file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious aCVE-2025-663705.0Kivitendo before 3.9.2 allows XXE injection. By uploading an electronic invoice in the ZUGFeRD format, it is possible to read and exfiltrateCVE-2025-663715.0Peppol-py before 1.1.1 allows XXE attacks because of the Saxon configuration. When validating XML-based invoices, the XML parser could read CVE-2025-663722.8Mustang before 2.16.3 allows exfiltrating files via XXE attacks.CVE-2025-663734.8Akamai Ghost on Akamai CDN edge servers before 2025-11-17 has a chunked request body processing error that can result in HTTP request smugglCVE-2025-663747.8CyberArk Endpoint Privilege Manager Agent through 25.10.0 allows a local user to achieve privilege escalation through policy elevation of an