CVE-2025-54331

MediumCVSS 5.3

Published: 04/11/2025(UTC)Updated: 05/11/2026(UTC)Translated: 05/11/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.31%

24th percentile - higher than 24% of all known CVEs

Summary

In the NPU component of Samsung Exynos 1380 (through July 2025) there is an untrusted pointer dereference of src_hdr in the copy_ncp_header function.

Risk Assessment

This may enable crashes or potential code execution in the NPU driver context, threatening device integrity.

Recommendation

Update the device firmware to a version with the vendor fix for Exynos 1380.

Other vulnerabilities in Samsung Exynos NPU

CVE-2025-54333Medium
In the NPU component of Samsung Exynos 1380 (through July 2025) there is an invalid pointer dereference of a node in the get_vs4l_profiler_node function.

Original NVD description (English source)

An issue was discovered in NPU in Samsung Mobile Processor Exynos 1380 through July 2025. There is an Untrusted Pointer Dereference of src_hdr in the copy_ncp_header function.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS