Loading vulnerability…
Out-of-Bounds Write in Samsung Exynos NPU Driver
CVE-2025-23107 is a high-severity out-of-bounds write vulnerability in the Samsung Exynos NPU driver affecting Exynos 1480 and Exynos 2400 platforms. The flaw is caused by a missing length check in the fill_vs4l_buffer function. That function copies reserved buffer metadata from the kernel-side queue_list back into a user-supplied vs4l_container_list structure, but iterates using kernel-side counts without verifying that the destination user-supplied container arrays are large enough. As a result, if c->count is smaller than queue_list->count, or if c->containers[i].count is smaller than queue_list->containers[i].count, the function can write past the end of the supplied buffer. The issue is reachable from the untrusted_app SELinux context and was demonstrated on Samsung Galaxy S24+ devices running Android 14, enabling local privilege escalation.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can allow a local attacker, including a malicious third-party Android application running with low privileges, to corrupt memory via out-of-bounds writes in the NPU driver. According to the provided context, this can lead to arbitrary writes into adjacent kernel memory and result in local privilege escalation. The CVSS 3.1 vector provided is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating potential high impact to confidentiality, integrity, and availability.
If you can’t patch tonight, do this now.
Until patched firmware is deployed, reduce exposure by preventing installation of untrusted third-party applications, especially on affected Samsung devices and Exynos 1480/2400 platforms. Enterprise controls such as application allow-listing, MDM-enforced installation restrictions, and rapid deployment of Samsung security updates can reduce risk. No specific vendor mitigation beyond patching was provided in the supplied content.
Patch, then assume compromise.
Samsung released a patch for CVE-2025-23107 through a Samsung Product Security Update on 2025-06-01. Remediation is to apply Samsung's security update that corrects the missing length validation in the affected NPU driver code path, specifically ensuring proper bounds checking in fill_vs4l_buffer before copying kernel-side metadata into user-controlled structures.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.