CVE-2025-54332 Null dereference in n/a

High 7.5 Published 4 Nov 2025 Updated 5 Nov 2025

A NULL pointer dereference in the Exynos 1380 NPU profiler function allows attackers to cause a denial of service.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-54332?

CVE-2025-54332 is a high-severity vulnerability in Samsung Exynos 1380 Firmware, published on 4 Nov 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An issue was discovered in NPU in Samsung Mobile Processor Exynos 1380 through July 2025. There is a NULL Pointer Dereference of profiler.node in the npu_vertex_profileoff function.

Weakness: CWE-476

Which versions are affected by CVE-2025-54332?

It affects 1 product.

Products include Samsung Exynos 1380 Firmware.

How do I fix CVE-2025-54332?

No fix has been published for CVE-2025-54332 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-54332 being exploited?

There is no known exploitation of CVE-2025-54332 in the wild and no public exploit code.

All Samsung Exynos 1380 Firmware vulnerabilities

Sources

Also known as GHSA-5mh8-jp8g-gm6g.