Cyber Posture

CVE-2025-62817

High

Published: 03 March 2026

Published
03 March 2026
Modified
10 March 2026
KEV Added
Patch
CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0010 26.8th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-62817 is a high-severity NULL Pointer Dereference (CWE-476) vulnerability in Samsung Exynos 1280 Firmware. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 26.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

Threat & Defense at a Glance

What attackers do: exploitation maps to Application or System Exploitation (T1499.004).
Threat & Defense Details

MITRE ATT&CK Enterprise TechniquesAI

T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
Why these techniques?

Remote network-exploitable null dereference enables direct application/system crash for DoS via vulnerability exploitation.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

An issue was discovered in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400, 1580, and 2500. A NULL pointer dereference of session->ncp_hdr_buf in __pilot_parsing_ncp() causes a denial of service.

Deeper analysisAI

CVE-2025-62817, published on 2026-03-03, is a NULL pointer dereference vulnerability (CWE-476) discovered in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400, 1580, and 2500. The flaw occurs in the __pilot_parsing_ncp() function due to dereferencing session->ncp_hdr_buf when it is NULL, leading to a denial of service condition.

The vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating it is exploitable over the network with low attack complexity, requiring no privileges or user interaction. Unauthenticated remote attackers can trigger the issue, achieving high-impact denial of service on affected Exynos processors without compromising confidentiality or integrity.

Samsung provides product security updates and mitigation details through its quality support portal at https://semiconductor.samsung.com/support/quality-support/product-security-updates/ and the dedicated CVE-2025-62817 page at https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-62817/. Security practitioners should consult these resources for patching guidance applicable to devices using the listed Exynos models.

Details

CWE(s)

Affected Products

samsung
exynos 1280 firmware
all versions
samsung
exynos 1380 firmware
all versions
samsung
exynos 1480 firmware
all versions
samsung
exynos 1580 firmware
all versions
samsung
exynos 2200 firmware
all versions
samsung
exynos 2400 firmware
all versions
samsung
exynos 2500 firmware
all versions

CVEs Like This One

CVE-2025-62814Same product: Samsung Exynos 1280
CVE-2025-52519Same product: Samsung Exynos 1380
CVE-2025-57835Same product: Samsung Exynos 1280
CVE-2025-58349Same product: Samsung Exynos 1280
CVE-2025-59440Same product: Samsung Exynos 1280
CVE-2025-57834Same product: Samsung Exynos 1280
CVE-2024-46922Same product: Samsung Exynos 1480
CVE-2024-52924Same product: Samsung Exynos 1280
CVE-2024-52923Same product: Samsung Exynos 1280
CVE-2024-50600Same product: Samsung Exynos 1280

References