CVE-2026-33970 Overview
CVE-2026-33970 is a null pointer dereference vulnerability [CWE-476] in the New Radio Radio Resource Control (NR RRC) and Layer 2 (L2) components of Samsung Exynos mobile, wearable, and modem processors. The flaw occurs in the 5G baseband when the affected components process a malformed RRC Reconfiguration message. Successful triggering leads to a limited denial of service in the baseband stack. The vulnerability affects a broad range of Samsung Exynos silicon used in mobile devices, wearables, and standalone modems.
Critical Impact
A malformed 5G NR RRC Reconfiguration message can crash the baseband, disrupting cellular connectivity on affected Exynos devices.
Affected Products
- Samsung Mobile Processor Exynos 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 2500, and 1680
- Samsung Wearable Processor Exynos W920, W930, and W1000
- Samsung Modem 5410
Discovery Timeline
- 2026-09-14 - CVE-2026-33970 published to the National Vulnerability Database (NVD)
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-33970
Vulnerability Analysis
The vulnerability resides in the NR RRC and L2 stacks implemented in Samsung Exynos 5G baseband firmware. RRC governs the control-plane signaling between the User Equipment (UE) and the gNodeB, including connection setup, mobility, and reconfiguration. When the baseband parses a malformed RRC Reconfiguration message, code paths dereference a pointer that was never initialized, resulting in a crash of the baseband processor.
Because the flaw is reached over the air via signaling from a base station, exploitation requires an attacker to control or impersonate a gNodeB reachable by the target UE. This typically involves a rogue base station or a false base station setup within radio range. Successful exploitation impacts availability of the baseband and cellular service on the affected device but does not affect confidentiality or integrity.
Root Cause
The root cause is a missing validation check on fields inside the incoming RRC Reconfiguration message. When required information elements are absent or malformed, the parser proceeds to use a pointer that remains NULL, producing an unhandled dereference within the baseband task. The condition maps directly to CWE-476: NULL Pointer Dereference.
Attack Vector
The attack vector is adjacent radio signaling. An attacker operating a rogue 5G NR base station transmits a crafted RRC Reconfiguration message to a target Exynos device. The malformed message reaches the RRC state machine after initial camping or connection procedures, triggering the NULL dereference and terminating the baseband task. No verified public proof-of-concept exploit is available for CVE-2026-33970.
No verified exploit code is available. Refer to the Samsung CVE-2026-33970 Advisory for vendor technical details.
Detection Methods for CVE-2026-33970
Indicators of Compromise
- Unexpected baseband resets or modem crash logs on Exynos devices without a corresponding user action or firmware update.
- Repeated loss of 5G NR service followed by fallback to LTE in a specific geographic area, indicating potential rogue base station activity.
- Kernel or RIL logs referencing RRC Reconfiguration processing failures on affected Exynos SoCs.
Detection Strategies
- Correlate mobile device management (MDM) telemetry for elevated modem restart counts across fleets of Samsung Exynos devices.
- Monitor for the presence of unauthorized 5G NR cells with unusual PLMN identifiers or cell IDs using wireless survey tools in sensitive locations.
- Review vendor crash dumps and modem ramoops for stack traces referencing NR RRC parsing functions.
Monitoring Recommendations
- Enroll affected Exynos devices in a mobile threat defense solution that reports baseband crashes and cellular anomalies.
- Track Samsung Semiconductor security bulletins and NVD updates for revisions to CVE-2026-33970 patch availability.
- Perform periodic RF sweeps in high-value locations to identify rogue gNodeB deployments.
How to Mitigate CVE-2026-33970
Immediate Actions Required
- Inventory all Samsung devices using the affected Exynos and Modem 5410 silicon and prioritize firmware update planning.
- Apply vendor baseband and modem firmware updates as soon as they are distributed by Samsung or the device OEM.
- In sensitive environments, disable 5G NR and force LTE-only mode where the operating system permits, reducing exposure to the vulnerable code path.
Patch Information
Samsung Semiconductor tracks fixes for this issue on its product security update portal. Consult the Samsung CVE-2026-33970 Advisory and the general Samsung Product Security Updates page for firmware version details. Device-level patches are delivered by handset and wearable OEMs through their standard security maintenance releases.
Workarounds
- Restrict use of affected devices to trusted mobile networks and avoid unknown or unmanaged 5G cells.
- Where feasible, configure preferred network mode to LTE-only until baseband firmware containing the fix is installed.
- Enable automatic security updates on managed devices to shorten the exposure window once OEMs publish fixed firmware.
# Example: query and set preferred network type on Android via ADB (LTE-only = 11)
adb shell settings get global preferred_network_mode
adb shell service call phone 8 i32 11
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
