CVE-2026-48173UnratedIn the NAS message handler, improper validation of the length field in NAS message causes memory corruption0.1%
CVE-2026-48174UnratedIn the NR RRC component, improper handling of messages before authentication triggers a data abort, which leads to a denial‑of‑service condition.0.2%
CVE-2026-35494UnratedIn the baseband, memory corruption during NAS packet processing can cause a denial of service.0.1%
CVE-2026-48175Medium 5.5Processing a malformed RRC message leads to an out-of-bounds read, resulting in a denial-of-service condition.<0.1%
CVE-2026-48186UnratedImproper handling of messages before AS security activation can cause unexpected behavior0.1%
CVE-2026-68984UnratedIn the Samsung Exynos NPU kernel driver, an integer overflow allows an unprivileged application to trigger memory corruption.0.1%
CVE-2026-68985UnratedIn the Samsung Exynos NPU driver, improper validation of user input in the ioctl handler can lead to an out-of-bounds write, which causes a denial of service.0.1%
CVE-2026-69006UnratedInsufficient validation of length fields in the GNSS firmware loader can result in kernel‑memory corruption.0.1%
CVE-2025-66366UnratedIncorrect handling of unauthenticated downlink RRC Setup messages can cause the baseband to crash0.1%
CVE-2025-66367UnratedImproper handling of NAS DLTransport messages may lead to a baseband crash.0.1%
CVE-2026-33958UnratedProcessing a malformed RRC Reconfiguration message leads to an out-of-bounds (OOB) access, resulting in a denial-of-service (DoS) condition.0.1%
CVE-2026-33971UnratedIn the LTE RRC component, improper handling of messages before authentication triggers a data abort, which leads to a denial‑of‑service condition.0.2%
CVE-2026-33969UnratedIn the NAS Authentication Request message decoding procedure, a missing lower bound check causes an infinite loop, leading to Denial of Service.0.2%
CVE-2025-66364UnratedContinuously sending control‑plane messages causes the baseband to crashes.0.1%