CVE-2025-66367

HighCVSS 7.5/10Last modified Nov 10, 2026

Description

Improper handling of NAS DLTransport messages may lead to a baseband crash.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-125

Affected software

VendorProductVersions
Samsung SemiconductorExynos 850< July 2026
Samsung SemiconductorExynos 2100< July 2026
Samsung SemiconductorExynos 1280< July 2026
Samsung SemiconductorExynos 2200< July 2026
Samsung SemiconductorExynos 1330< July 2026
Samsung SemiconductorExynos 1380< July 2026
Samsung SemiconductorExynos 1480< July 2026
Samsung SemiconductorExynos 2400< July 2026
Samsung SemiconductorExynos 1580< July 2026
Samsung SemiconductorExynos 2500< July 2026
Samsung SemiconductorExynos 1680< July 2026
Samsung SemiconductorExynos W920< July 2026
Samsung SemiconductorExynos W930< July 2026
Samsung SemiconductorExynos W1000< July 2026
Samsung SemiconductorExynos Modem 5123< July 2026
Samsung SemiconductorExynos Modem 5300< July 2026
Samsung SemiconductorExynos Modem 5400< July 2026
Samsung SemiconductorExynos Modem 5410< July 2026

References

Timeline

Published
Nov 5, 2026
Last modified
Nov 10, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-663687.5Incorrect handling of SDP payload leads to a Denial of ServiceCVE-2025-663697.5An issue was discovered in MM in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 2100, 1280, 2200, 1330, 1380,CVE-2025-66377.8A maliciously crafted PRT file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious aCVE-2025-663705.0Kivitendo before 3.9.2 allows XXE injection. By uploading an electronic invoice in the ZUGFeRD format, it is possible to read and exfiltrateCVE-2025-663715.0Peppol-py before 1.1.1 allows XXE attacks because of the Saxon configuration. When validating XML-based invoices, the XML parser could read CVE-2025-663722.8Mustang before 2.16.3 allows exfiltrating files via XXE attacks.CVE-2025-663734.8Akamai Ghost on Akamai CDN edge servers before 2025-11-17 has a chunked request body processing error that can result in HTTP request smugglCVE-2025-663747.8CyberArk Endpoint Privilege Manager Agent through 25.10.0 allows a local user to achieve privilege escalation through policy elevation of anCVE-2025-663766.1Zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets (CSS) @import dCVE-2025-663777.5Pexip Infinity before 39.0 has Missing Authentication for a Critical Function in a product-internal API, allowing an attacker (who already hCVE-2025-663787.5Pexip Infinity 38.0 and 38.1 before 39.0 has insufficient access control in the RTMP implementation, allowing an attacker to disconnect RTMPCVE-2025-663797.5Pexip Infinity before 39.0 has Improper Input Validation in the media implementation, allowing a remote attacker to trigger a software abort
CVE-2025-66367: High severity, CVSS 7.5 | Vulnix