Cyber Resilience

CVE-2025-54333

Samsung Exynos 1380 Firmware ≤ 2025-07

Published
04 November 2025
Modified
07 November 2025
Patch / advisory
View advisory
CVSS Score v3.1 5.3
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
EPSS Score 0.0029 21th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2025-54333 is a medium-severity Release of Invalid Pointer or Reference (CWE-763) vulnerability in Samsung Exynos 1380 Firmware. Its CVSS base score is 5.3 (Medium).

Operationally, ranked at the 21th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SI-16 (Memory Protection) and SI-2 (Flaw Remediation) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

An issue was discovered in NPU in Samsung Mobile Processor Exynos 1380 through July 2025. There is an Invalid Pointer Dereference of node in the get_vs4l_profiler_node function.

CWE(s)
CWE-763

Related Threats

CVEs Like This One

CVE-2025-54330Same product: Samsung Exynos 1380
CVE-2025-54332Same product: Samsung Exynos 1380
CVE-2025-54331Same product: Samsung Exynos 1380
CVE-2025-23097Same product: Samsung Exynos 1380
CVE-2025-23101Same product: Samsung Exynos 1380
CVE-2024-25074Same product: Samsung Exynos 1380
CVE-2024-27386Same product: Samsung Exynos 1380
CVE-2026-47312Same vendor: Samsung
CVE-2024-27385Same product: Samsung Exynos 1380
CVE-2025-54327Same product: Samsung Exynos 1380

Affected Assets

samsung
exynos 1380 firmware
≤ 2025-07

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)

—

Mitigating Controls (NIST 800-53 r5) AI

SI-16 Memory Protection good match
prevent

Directly enforces memory-protection mechanisms that block invalid pointer dereferences such as the one in get_vs4l_profiler_node.

SI-2 Flaw Remediation good match
prevent

Requires timely patching of the identified flaw in the Exynos NPU driver before exploitation can occur.

SC-39 Process Isolation partial match
prevent

Process isolation limits the blast radius of a dereference occurring inside the NPU subsystem.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly prevent invalid pointer release errors during development.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
detects

Security testing can detect invalid pointer releases before release.

A.8.25 Secure development life cycle partial match
prevents

Secure SDLC practices can mandate proper memory-management APIs and reviews that catch incorrect deallocation.

A.8.26 Application security requirements partial match
prevents

Application security requirements can specify correct use of release functions and pointer validation.

A.8.27 Secure system architecture and engineering principles partial match
prevents

Secure architecture principles include safe memory handling and resource-lifetime rules.

A.8.28 Secure coding partial match
prevents

Secure coding standards directly prohibit mismatched or incorrect pointer-release calls.

References