CVE-2025-54330: Out-of-bounds Read
Source CVE Database V5
Not known to be exploited · CVSS 5.3 Medium.
Data as of 26 Oct 2026, 09:15 UTC
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 17% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 4 Nov 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
1. Monitor Samsung's official security advisories and apply firmware or software updates promptly once patches for CVE-2025-54330 are released. 2. Until patches are available, restrict network exposure of devices with Exynos 1380 processors by limiting connections to trusted networks and disabling unnecessary services that interface with the NPU. 3. Employ mobile device management (MDM) solutions to enforce security policies, restrict installation of untrusted applications, and monitor device behavior for anomalies. 4. Educate users about avoiding suspicious links, apps, or network connections that could trigger exploitation attempts targeting the NPU. 5. For organizations developing AI or machine learning applications on affected devices, review and harden interfaces interacting with the NPU to reduce attack surface. 6. Conduct regular security assessments and penetration tests focusing on mobile endpoints to detect potential exploitation attempts. 7. Collaborate with Samsung and mobile security vendors to gain early access to patches or mitigations and share threat intelligence related to this vulnerability.
Description
An issue was discovered in NPU in Samsung Mobile Processor Exynos 1380 through July 2025. There is an Out-of-bounds Read of q->bufs[] in the __is_done_for_me function.