CVE-2025-54331
Samsung Exynos 1380 Firmware ≤ 2025-07
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LSummary
CVE-2025-54331 is a medium-severity Untrusted Pointer Dereference (CWE-822) vulnerability in Samsung Exynos 1380 Firmware. Its CVSS base score is 5.3 (Medium).
Operationally, ranked at the 21th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and SI-16 (Memory Protection) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-37846
Vulnerability Data
An issue was discovered in NPU in Samsung Mobile Processor Exynos 1380 through July 2025. There is an Untrusted Pointer Dereference of src_hdr in the copy_ncp_header function.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Validates the src_hdr structure before any pointer dereference in copy_ncp_header, directly blocking the untrusted pointer CWE-822 flaw.
Enforces memory protection boundaries around NPU data structures so an invalid src_hdr dereference cannot corrupt or escape the process.
Isolates the Exynos NPU execution environment, limiting the blast radius of a successful pointer dereference to only NPU-accessible memory.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly prevent introduction of untrusted pointer handling during development.
Runtime monitoring of software and data can detect adverse events resulting from exploitation of the weakness.
Vulnerability identification processes can discover instances of this weakness via code review or scanning.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect pointer-dereference flaws before release.
Secure development lifecycle includes pointer-safety practices that reduce untrusted pointer dereference risk.
Application security requirements can mandate validation of pointers obtained from untrusted sources.
Secure architecture principles discourage direct use of untrusted values as pointers.
Secure coding standards explicitly forbid dereferencing pointers derived from untrusted input.