Samsung Mobile
Page 2 of 14 — Samsung Mobile CVEs from a corpus of 1362, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-20984 | | 2026-02-04 | Improper handling of insufficient permission in Galaxy Wearable installed on non-Samsung Device prior to version 2.2.68 allows local attackers to access sensit… | |
CVE-2026-20983 | High | 7.8 | 2026-02-04 | Improper export of android application components in Samsung Dialer prior to SMR Feb-2026 Release 1 allows local attackers to launch arbitrary activity with Sa… |
CVE-2026-20982 | Medium | 6.0 | 2026-02-04 | Path traversal in ShortcutService prior to SMR Feb-2026 Release 1 allows privileged local attacker to create file with system privilege. |
CVE-2026-20981 | Medium | 6.6 | 2026-02-04 | Improper input validation in FacAtFunction prior to SMR Feb-2026 Release 1 allows privileged physical attacker to execute arbitrary command with system privile… |
CVE-2026-20980 | Medium | 6.8 | 2026-02-04 | Improper input validation in PACM prior to SMR Feb-2026 Release 1 allows physical attacker to execute arbitrary commands. |
CVE-2026-20979 | High | 7.8 | 2026-02-04 | Improper privilege management in Settings prior to SMR Feb-2026 Release 1 allows local attackers to launch arbitrary activity with Settings privilege. |
CVE-2026-20978 | Medium | 6.1 | 2026-02-04 | Improper authorization in KnoxGuardManager prior to SMR Feb-2026 Release 1 allows local attackers to bypass the persistence configuration of the application. |
CVE-2026-20977 | Medium | 5.5 | 2026-02-04 | Improper access control in Emergency Sharing prior to SMR Feb-2026 Release 1 allows local attackers to interrupt its functioning. |
CVE-2026-20976 | High | 7.8 | 2026-01-09 | Improper input validation in Galaxy Store prior to version 4.6.02 allows local attacker to execute arbitrary script. |
CVE-2026-20975 | Medium | 5.5 | 2026-01-09 | Improper handling of insufficient permission in Samsung Cloud prior to version 5.6.11 allows local attackers to access specific files in arbitrary path. |
CVE-2026-20974 | Medium | 4.6 | 2026-01-09 | Improper input validation in data related to network restrictions prior to SMR Jan-2026 Release 1 allows physical attackers to bypass Carrier Relock. |
CVE-2026-20973 | Medium | 5.3 | 2026-01-09 | Out-of-bounds read in libimagecodec.quram.so prior to SMR Jan-2026 Release 1 allows remote attacker to access out-of-bounds memory. |
CVE-2026-20972 | Low | 3.3 | 2026-01-09 | Improper Export of Android Application Components in UwbTest prior to SMR Jan-2026 Release 1 allows local attackers to enable UWB. |
CVE-2026-20971 | High | 7.8 | 2026-01-09 | Use After Free in PROCA driver prior to SMR Jan-2026 Release 1 allows local attackers to potentially execute arbitrary code. |
CVE-2026-20970 | High | 7.8 | 2026-01-09 | Improper access control in SLocation prior to SMR Jan-2026 Release 1 allows local attackers to execute the privileged APIs. |
CVE-2026-20969 | Medium | 5.5 | 2026-01-09 | Improper input validation in SecSettings prior to SMR Jan-2026 Release 1 allows local attacker to access file with system privilege. User interaction is requir… |
CVE-2026-20968 | Medium | 6.7 | 2026-01-09 | Use after free in DualDAR prior to SMR Jan-2026 Release 1 allows local privileged attackers to execute arbitrary code. |
CVE-2025-58488 | Medium | 4.5 | 2025-12-02 | Improper verification of source of a communication channel in SmartTouchCall prior to version 1.0.1.1 allows remote attackers to access sensitive information… |
CVE-2025-58487 | Medium | 4.0 | 2025-12-02 | Improper authorization in Samsung Account prior to version 15.5.01.1 allows local attacker to launch arbitrary activity with Samsung Account privilege. |
CVE-2025-58486 | Medium | 4.0 | 2025-12-02 | Improper input validation in Samsung Account prior to version 15.5.01.1 allows local attacker to execute arbitrary script. |
CVE-2025-58485 | Medium | 5.5 | 2025-12-02 | Improper input validation in Samsung Internet prior to version 29.0.0.48 allows local attackers to inject arbitrary script. |
CVE-2025-58484 | Medium | 4.0 | 2025-12-02 | Incorrect default permissions in Samsung Cloud Assistant prior to version 8.0.03.8 allows local attacker to access partial data in sandbox. |
CVE-2025-58483 | Medium | 5.9 | 2025-12-02 | Improper export of android application components in Galaxy Store for Galaxy Watch prior to version 1.0.06.29 allows local attacker to install arbitrary applic… |
CVE-2025-58482 | High | 7.3 | 2025-12-02 | Improper access control in MPLocalService of MotionPhoto prior to version 4.1.51 allows local attackers to start privileged service. |
CVE-2025-58481 | High | 7.3 | 2025-12-02 | Improper access control in MPRemoteService of MotionPhoto prior to version 4.1.51 allows local attackers to start privileged service. |
CVE-2025-58480 | Medium | 4.3 | 2025-12-02 | Heap-based buffer overflow in libimagecodec.quram.so prior to SMR Dec-2025 Release 1 allows remote attackers to access out-of-bounds memory. |
CVE-2025-58479 | Medium | 4.3 | 2025-12-02 | Out-of-bounds read in libimagecodec.quram.so prior to SMR Dec-2025 Release 1 allows remote attackers to access out-of-bounds memory. |
CVE-2025-58478 | Medium | 4.3 | 2025-12-02 | Out-of-bounds write in libimagecodec.quram.so prior to SMR Dec-2025 Release 1 allows remote attackers to access out-of-bounds memory. |
CVE-2025-58477 | Medium | 4.3 | 2025-12-02 | Out-of-bounds write in parsing IFD tag in libimagecodec.quram.so prior to SMR Dec-2025 Release 1 allows remote attackers to access out-of-bounds memory. |
CVE-2025-58476 | Medium | 4.2 | 2025-12-02 | Out-of-bounds read vulnerability in bootloader prior to SMR Dec-2025 Release 1 allows physical attackers to access out-of-bounds memory. |
CVE-2025-58475 | Medium | 5.6 | 2025-12-02 | Improper input validation in libsec-ril.so prior to SMR Dec-2025 Release 1 allows local privileged attackers to write out-of-bounds memory. |
CVE-2025-21080 | Medium | 6.2 | 2025-12-02 | Improper export of android application components in Dynamic Lockscreen prior to SMR Dec-2025 Release 1 allows local attackers to access files with Dynamic Loc… |
CVE-2025-21072 | Medium | 5.7 | 2025-12-02 | Out-of-bounds write in decoding metadata in fingerprint trustlet prior to SMR Dec-2025 Release 1 allows local privileged attackers to write out-of-bounds memor… |
CVE-2025-21079 | High | 7.1 | 2025-11-05 | Improper input validation in Samsung Members prior to version 5.5.01.3 allows remote attackers to connect arbitrary URL and launch arbitrary activity with Sams… |
CVE-2025-21078 | High | 8.8 | 2025-11-05 | Use of insufficiently random value of secretKey in Smart Switch prior to version 3.7.68.6 allows adjacent attackers to access backup data from applications. |
CVE-2025-21077 | Low | 3.3 | 2025-11-05 | Improper input validation in Samsung Email prior to version 6.2.06.0 allows local attackers to launch arbitrary activity with Samsung Email privilege. |
CVE-2025-21076 | Medium | 5.5 | 2025-11-05 | Improper handling of insufficient permissions or privileges in Samsung Account prior to version 15.5.00.18 allows local attackers to access data in Samsung Acc… |
CVE-2025-21075 | Medium | 4.3 | 2025-11-05 | Out-of-bounds write in libimagecodec.quram.so prior to SMR Nov-2025 Release 1 allows remote attackers to access out-of-bounds memory. |
CVE-2025-21074 | Medium | 4.3 | 2025-11-05 | Out-of-bounds read in libimagecodec.quram.so prior to SMR Nov-2025 Release 1 allows remote attackers to access out-of-bounds memory. |
CVE-2025-21073 | Medium | 6.8 | 2025-11-05 | Insecure default configuration in USB connection mode prior to SMR Nov-2025 Release 1 allows privileged physical attackers to access user data. User interactio… |
CVE-2025-21071 | Medium | 5.7 | 2025-11-05 | Out-of-bounds write in handling opcode in fingerprint trustlet prior to SMR Nov-2025 Release 1 allows local privileged attackers to write out-of-bounds memory. |
CVE-2025-21070 | Medium | 4.0 | 2025-10-10 | Out-of-bounds write in the SPI decoder in Samsung Notes prior to version 4.4.30.63 allows local attackers to write out-of-bounds memory. |
CVE-2025-21069 | Medium | 4.0 | 2025-10-10 | Out-of-bounds read in the parsing of image data in Samsung Notes prior to version 4.4.30.63 allows local attackers to access out-of-bounds memory. |
CVE-2025-21068 | Medium | 4.0 | 2025-10-10 | Out-of-bounds read in the reading of image data in Samsung Notes prior to version 4.4.30.63 allows local attackers to access out-of-bounds memory. |
CVE-2025-21067 | Medium | 4.0 | 2025-10-10 | Out-of-bounds read in the allocation of image buffer in Samsung Notes prior to version 4.4.30.63 allows local attackers to access out-of-bounds memory. |
CVE-2025-21066 | Medium | 4.0 | 2025-10-10 | Out-of-bounds read in the SPI decoder in Samsung Notes prior to version 4.4.30.63 allows local attackers to access out-of-bounds memory. |
CVE-2025-21065 | Medium | 6.6 | 2025-10-10 | Improper input validation in Retail Mode prior to version 5.59.11 allows self attackers to execute privileged commands on their own devices. |
CVE-2025-21064 | High | 8.8 | 2025-10-10 | Improper authentication in Smart Switch prior to version 3.7.66.6 allows adjacent attackers to access transferring data. |
CVE-2025-21063 | Medium | 4.6 | 2025-10-10 | Improper access control in Samsung Voice Recorder prior to version 21.5.73.12 in Android 15 and 21.5.81.40 in Android 16 allows physical attackers to access re… |
CVE-2025-21062 | High | 7.8 | 2025-10-10 | Use of a broken or risky cryptographic algorithm in Smart Switch prior to version 3.7.67.2 allows local attackers to replace the restoring application. User in… |
CVE-2025-21061 | High | 7.1 | 2025-10-10 | Cleartext storage of sensitive information in Smart Switch prior to version 3.7.67.2 allows local attackers to access sensitive data. User interaction is requi… |
CVE-2025-21060 | Medium | 5.5 | 2025-10-10 | Cleartext storage of sensitive information in Smart Switch prior to version 3.7.67.2 allows local attackers to access backup data from applications. User inter… |
CVE-2025-21059 | Medium | 6.2 | 2025-10-10 | Improper authorization in Samsung Health prior to version 6.30.5.105 allows local attackers to access data in Samsung Health. |
CVE-2025-21058 | High | 7.3 | 2025-10-10 | Improper access control in Routines prior to version 4.8.7.1 in Android 15 and 4.9.6.0 in Android 16 allows local attackers to potentially execute arbitrary co… |
CVE-2025-21057 | Medium | 4.0 | 2025-10-10 | Use of implicit intent for sensitive communication in Samsung Notes prior to version 4.4.30.63 allows local attackers to access shared notes. |
CVE-2025-21055 | Medium | 4.3 | 2025-10-10 | Out-of-bounds read and write in libimagecodec.quram.so prior to SMR Oct-2025 Release 1 allows remote attackers to access out-of-bounds memory. |
CVE-2025-21054 | Medium | 4.0 | 2025-10-10 | Out-of-bounds read in the parsing header for JPEG decoding in libpadm.so prior to SMR Oct-2025 Release 1 allows local attackers to potentially access out-of-bo… |
CVE-2025-21053 | Medium | 4.0 | 2025-10-10 | Out-of-bounds write in the parsing header for JPEG decoding in libpadm.so prior to SMR Oct-2025 Release 1 allows local attackers to cause memory corruption. |
CVE-2025-21052 | Medium | 4.0 | 2025-10-10 | Out-of-bounds write under specific condition in the pre-processing of JPEG decoding in libpadm.so prior to SMR Oct-2025 Release 1 allows local attackers to cau… |
CVE-2025-21051 | Medium | 4.0 | 2025-10-10 | Out-of-bounds write in the pre-processing of JPEG decoding in libpadm.so prior to SMR Oct-2025 Release 1 allows local attackers to write out-of-bounds memory. |
CVE-2025-21050 | High | 7.1 | 2025-10-10 | Improper input validiation in Contacts prior to SMR Oct-2025 Release 1 allows local attackers to access data across multiple user profiles. |
CVE-2025-21049 | Medium | 5.5 | 2025-10-10 | Improper access control in SecSettings prior to SMR Oct-2025 Release 1 allows local attackers to access sensitive information. User interaction is required for… |
CVE-2025-21048 | Medium | 6.7 | 2025-10-10 | Relative path traversal in Knox Enterprise prior to SMR Oct-2025 Release 1 allows local attackers to execute arbitrary code. |
CVE-2025-21047 | Medium | 5.2 | 2025-10-10 | Improper access control in KnoxGuard prior to SMR Oct-2025 Release 1 allows physical attackers to use the privileged APIs. |
CVE-2025-21046 | Low | 2.4 | 2025-10-10 | Improper access control in WindowManager in Samsung DeX prior to SMR Oct-2025 Release 1 allows physical attackers to temporarily access to recent app list. |
CVE-2025-21045 | Medium | 4.0 | 2025-10-10 | Insecure storage of sensitive information in Galaxy Watch prior to SMR Oct-2025 Release 1 allows local attackers to access sensitive information. |
CVE-2025-21044 | Medium | 5.7 | 2025-10-10 | Out-of-bounds write in fingerprint trustlet prior to SMR Oct-2025 Release 1 allows local privileged attackers to write out-of-bounds memory. |
CVE-2025-21056 | Medium | 6.6 | 2025-09-25 | Improper input validation in Retail Mode prior to version 5.59.4 allows self attackers to execute privileged commands on their own devices. |
CVE-2025-21043 | High | 8.8 | 2025-09-12 | Out-of-bounds write in libimagecodec.quram.so prior to SMR Sep-2025 Release 1 allows remote attackers to execute arbitrary code. |
CVE-2025-21042 | High | 8.8 | 2025-09-12 | Out-of-bounds write in libimagecodec.quram.so prior to SMR Apr-2025 Release 1 allows remote attackers to execute arbitrary code. |
CVE-2024-34598 | High | 7.7 | 2025-09-04 | Improper export of component in GoodLock prior to version 2.2.04.95 allows local attackers to install arbitrary applications from Galaxy Store. |
CVE-2022-39888 | Medium | 4.3 | 2025-09-04 | Improper access control vulnerability in retrieveExternalProxy in MiscPolicy prior to SMR Nov-2022 Release 1 allows local attacker to access to Proxy informati… |
CVE-2025-21041 | Medium | 6.2 | 2025-09-03 | Insecure Storage of Sensitive Information in Secure Folder prior to Android 16 allows local attackers to access sensitive information. |
CVE-2025-21040 | Medium | 5.1 | 2025-09-03 | Improper verification of intent by ExternalBroadcastReceiver in S Assistant prior to version 9.3.2 allows local attackers to modify itinerary information. |
CVE-2025-21039 | Medium | 5.1 | 2025-09-03 | Improper verification of intent by SystemExceptionalBroadcastReceiver in S Assistant prior to version 9.3.2 allows local attackers to modify itinerary informat… |
CVE-2025-21038 | Medium | 5.1 | 2025-09-03 | Improper verification of intent by SamsungExceptionalBroadcastReceiver in S Assistant prior to version 9.3.2 allows local attackers to modify itinerary informa… |
CVE-2025-21037 | Medium | 4.1 | 2025-09-03 | Improper access control in Samsung Notes prior to version 4.4.30.63 allows physical attackers to access data across multiple user profiles. User interaction is… |
CVE-2025-21036 | Medium | 5.0 | 2025-09-03 | Improper access control in Samsung Notes prior to version 4.4.30.63 allows local privileged attackers to access exported note files. User interaction is requir… |
CVE-2025-21035 | Medium | 4.6 | 2025-09-03 | Improper access control in Samsung Calendar prior to version 12.5.06.5 in Android 14 and 12.6.01.12 in Android 15 allows physical attackers to access data acro… |
CVE-2025-21034 | Medium | 4.0 | 2025-09-03 | Out-of-bounds write in libsavsvc.so prior to SMR Sep-2025 Release 1 allows local attackers to potentially execute arbitrary code. |
CVE-2025-21033 | Medium | 4.0 | 2025-09-03 | Improper access control in ContactProvider prior to SMR Sep-2025 Release 1 allows local attackers to access sensitive information. |
CVE-2025-21032 | Medium | 5.9 | 2025-09-03 | Improper access control in One UI Home prior to SMR Sep-2025 Release 1 allows physical attackers to bypass Kiosk mode under limited conditions. |
CVE-2025-21031 | Medium | 6.8 | 2025-09-03 | Improper access control in ImsService prior to SMR Sep-2025 Release 1 allows local attackers to use the privileged APIs. |
CVE-2025-21030 | Medium | 4.3 | 2025-09-03 | Improper handling of insufficient permission in AppPrelaunchManagerService prior to SMR Sep-2025 Release 1 in Chinese Android 15 allows local attackers to exec… |
CVE-2025-21029 | Medium | 4.0 | 2025-09-03 | Improper handling of insufficient permission in System UI prior to SMR Sep-2025 Release 1 allows local attackers to send arbitrary replies to messages from the… |
CVE-2025-21028 | Medium | 5.5 | 2025-09-03 | Improper privilege management in ThemeManager prior to SMR Sep-2025 Release 1 allows local privileged attackers to reuse trial items. |
CVE-2025-21027 | Medium | 5.1 | 2025-09-03 | Improper verification of intent by broadcast receiver in ImsService prior to SMR Sep-2025 Release 1 allows local attackers to temporarily disable the SIM. |
CVE-2025-21026 | Medium | 4.0 | 2025-09-03 | Improper handling of insufficient permission in ImsService prior to SMR Sep-2025 Release 1 allows local attackers to interrupt the call. |
CVE-2025-21025 | Medium | 5.1 | 2025-09-03 | Improper access control in MARsExemptionManager prior to SMR Sep-2025 Release 1 allows local attackers to be excluded from background execution management. |
CVE-2023-21483 | Medium | 6.4 | 2025-09-03 | Improper Access Control vulnerability in Galaxy Store prior to version 4.5.53.6 allows local attacker to access protected data using exported service. |
CVE-2023-21482 | Medium | 6.1 | 2025-09-03 | Missing authorization vulnerability in Camera prior to versions 11.1.02.18 in Android 11, 12.1.03.8 in Android 12 and 13.1.01.4 in Android 13 allows physical… |
CVE-2023-21481 | Medium | 5.4 | 2025-09-03 | Improper URL input validation vulnerability in Samsung Account application prior to version 14.1.0.0 allows remote attackers to get sensitive information. |
CVE-2023-21480 | High | 8.5 | 2025-09-03 | Improper input validation vulnerability in CertByte prior to SMR Apr-2023 Release 1 allows local attackers to launch privileged activities. |
CVE-2023-21479 | Medium | 5.3 | 2025-09-03 | Improper authorization in Smart suggestions prior to SMR Apr-2023 Release 1 in Android 13 and 4.1.01.0 in Android 12 allows remote attackers to register a sche… |
CVE-2023-21478 | Medium | 6.0 | 2025-09-03 | Improper input validation vulnerability in TIGERF trustlet prior to SMR Apr-2023 Release 1 allows local attackers to access protected data. |
CVE-2023-21477 | High | 7.9 | 2025-09-03 | Access of Memory Location After End of Buffer vulnerability in TIGERF trustlet prior to SMR Apr-2023 Release 1 allows local attackers to access protected data. |
CVE-2023-21476 | High | 8.0 | 2025-09-03 | Out-of-bounds Write vulnerability in libaudiosaplus_sec.so library prior to SMR Apr-2023 Release 1 allows local attacker to execute arbitrary code. |
CVE-2023-21475 | High | 8.0 | 2025-09-03 | Out-of-bounds Write vulnerability in libaudiosaplus_sec.so library prior to SMR Apr-2023 Release 1 allows local attacker to execute arbitrary code. |
CVE-2023-21474 | Medium | 6.3 | 2025-09-03 | Intent redirection vulnerability in SecSettings prior to SMR Apr-2022 Release 1 allows attackers to access arbitrary file with system privilege. |
CVE-2023-21473 | Medium | 6.8 | 2025-09-03 | Improper input validation with Exynos Fastboot USB Interface prior to SMR Apr-2023 Release 1 allows a physical attacker to execute arbitrary code in bootloader. |