Samsung Mobile
Page 3 of 14 — Samsung Mobile CVEs from a corpus of 1362, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-21472 | Medium | 6.8 | 2025-09-03 | Improper input validation with Exynos Fastboot USB Interface prior to SMR Apr-2023 Release 1 allows a physical attacker to execute arbitrary code in bootloader. |
CVE-2023-21471 | Medium | 4.0 | 2025-09-03 | Improper access control vulnerability in SemClipboard prior to SMR Apr-2023 Release 1 allows attackers to read arbitrary files with system permission. |
CVE-2023-21470 | Medium | 4.0 | 2025-09-03 | Improper access control vulnerability in SLocation prior to SMR Apr-2022 Release 1 allows local attackers to get device location information using com.samsung… |
CVE-2023-21469 | Medium | 4.0 | 2025-09-03 | Improper access control vulnerability in SLocation prior to SMR Apr-2022 Release 1 allows local attackers to get device location information using com.samsung… |
CVE-2023-21468 | Medium | 5.9 | 2025-09-03 | Improper access control vulnerability in Telephony prior to SMR Apr-2023 Release 1 allows attackers to access files with escalated permission. |
CVE-2023-21467 | Medium | 4.6 | 2025-09-03 | Error in 3GPP specification implementation in Exynos baseband prior to SMR Apr-2023 Release 1 allows incorrect handling of unencrypted message. |
CVE-2023-21466 | Medium | 5.3 | 2025-09-03 | PendingIntent hijacking vulnerability in CertificatePolicy in framework prior to SMR Apr-2023 Release 1 allows local attackers to access contentProvider withou… |
CVE-2025-21024 | Low | 3.3 | 2025-08-06 | Use of Implicit Intent for Sensitive Communication in Smart View prior to Android 16 allows local attackers to access sensitive information. |
CVE-2025-21023 | Low | 3.3 | 2025-08-06 | Improper access control in WcsExtension for Galaxy Watch prior to Android Watch 16 allows local attackers to access sensitive information. |
CVE-2025-21022 | Low | 3.3 | 2025-08-06 | Improper access control in Galaxy Wearable prior to version 2.2.63.25042861 allows local attackers to access sensitive information. |
CVE-2025-21021 | Medium | 5.7 | 2025-08-06 | Out-of-bounds write in drawing pinpad in Blockchain Keystore prior to version 1.3.17.2 allows local privileged attackers to write out-of-bounds memory. |
CVE-2025-21020 | Medium | 5.7 | 2025-08-06 | Out-of-bounds write in creating bitmap images in Blockchain Keystore prior to version 1.3.17.2 allows local privileged attackers to write out-of-bounds memory. |
CVE-2025-21019 | Medium | 5.5 | 2025-08-06 | Improper authorization in Samsung Health prior to version 6.30.1.003 allows local attackers to access data in Samsung Health. User interaction is required for… |
CVE-2025-21018 | Medium | 4.4 | 2025-08-06 | Out-of-bounds read in Blockchain Keystore prior to version 1.3.17.2 allows local privileged attackers to read out-of-bounds memory. |
CVE-2025-21017 | Medium | 6.3 | 2025-08-06 | Out-of-bounds write in detaching crypto box in Blockchain Keystore prior to version 1.3.17.2 allows local privileged attackers to write out-of-bounds memory. |
CVE-2025-21016 | Medium | 4.3 | 2025-08-06 | Improper access control in PkgPredictorService prior to SMR Aug-2025 Release 1 in Chinese Android 13, 14, 15 and 16 allows local attackers to use the privilege… |
CVE-2025-21015 | Medium | 4.0 | 2025-08-06 | Path Traversal in Document scanner prior to SMR Aug-2025 Release 1 allows local attackers to delete file with Document scanner's privilege. |
CVE-2025-21014 | Medium | 4.3 | 2025-08-06 | Improper export of android application component in Emergency SoS prior to SMR Aug-2025 Release 1 allows local attackers to access sensitive information. |
CVE-2025-21013 | Medium | 6.2 | 2025-08-06 | Improper access control in SemSensorManager for Galaxy Watch prior to SMR Aug-2025 Release 1 allows local attackers to access sensitive information related to… |
CVE-2025-21012 | Medium | 5.5 | 2025-08-06 | Improper access control in fall detection for Galaxy Watch prior to SMR Aug-2025 Release 1 allows local attackers to modify fall detection configuration. |
CVE-2025-21011 | Medium | 5.5 | 2025-08-06 | Improper access control in SemSensorService for Galaxy Watch prior to SMR Aug-2025 Release 1 allows local attackers to access sensitive information related to… |
CVE-2025-21010 | Medium | 6.0 | 2025-08-06 | Improper privilege management in SamsungAccount prior to SMR Aug-2025 Release 1 allows local privileged attackers to deactivate Samsung account. |
CVE-2025-20990 | Medium | 4.0 | 2025-08-06 | Improper access control in accessing system device node prior to SMR Aug-2025 Release 1 allows local attackers to access device identifier. |
CVE-2025-21009 | Medium | 5.5 | 2025-07-08 | Out-of-bounds read in decoding malformed frame header in libsavsvc.so prior to Android 15 allows local attackers to cause memory corruption. |
CVE-2025-21008 | Medium | 5.5 | 2025-07-08 | Out-of-bounds read in decoding frame header in libsavsvc.so prior to Android 15 allows local attackers to cause memory corruption. |
CVE-2025-21007 | Medium | 5.5 | 2025-07-08 | Out-of-bounds write in accessing uninitialized memory in libsavsvc.so prior to Android 15 allows local attackers to cause memory corruption. |
CVE-2025-21006 | High | 7.0 | 2025-07-08 | Out-of-bounds write in handling of macro blocks for MPEG4 codec in libsavsvc.so prior to Android 15 allows local attackers to write out-of-bounds memory. |
CVE-2025-21005 | Medium | 5.5 | 2025-07-08 | Improper access control in isemtelephony prior to Android 15 allows local attackers to access sensitive information. |
CVE-2025-21004 | Medium | 6.2 | 2025-07-08 | Improper verification of intent by broadcast receiver in System UI for Galaxy Watch prior to SMR Jul-2025 Release 1 allows local attackers to power off the dev… |
CVE-2025-21003 | Medium | 4.0 | 2025-07-08 | Insecure storage of sensitive information in Emergency SOS prior to SMR Jul-2025 Release 1 allows local attackers to access sensitive information. |
CVE-2025-21002 | Medium | 6.2 | 2025-07-08 | Improper access control in LeAudioService prior to SMR Jul-2025 Release 1 allows local attackers to manipulate broadcasting Auracast. |
CVE-2025-21001 | Medium | 6.2 | 2025-07-08 | Improper access control in LeAudioService prior to SMR Jul-2025 Release 1 allows local attackers to stop broadcasting Auracast. |
CVE-2025-21000 | Medium | 6.2 | 2025-07-08 | Improper privilege management in Bluetooth prior to SMR Jul-2025 Release 1 allows local attackers to enable Bluetooth. |
CVE-2025-20999 | Medium | 4.1 | 2025-07-08 | Improper authorization in accessing saved Wi-Fi password for Galaxy Tablet prior to SMR Jul-2025 Release 1 allows secondary users to access owner's saved Wi-Fi… |
CVE-2025-20998 | Medium | 5.5 | 2025-07-08 | Improper access control in SamsungAccount for Galaxy Watch prior to SMR Jul-2025 Release 1 allows local attackers to access phone number. |
CVE-2025-20997 | Medium | 6.2 | 2025-07-08 | Incorrect default permission in Framework for Galaxy Watch prior to SMR Jul-2025 Release 1 allows local attackers to reset some configuration of Galaxy Watch. |
CVE-2025-20983 | Medium | 6.4 | 2025-07-08 | Out-of-bounds write in checking auth secret in KnoxVault trustlet prior to SMR Jul-2025 Release 1 allows local privileged attackers to write out-of-bounds memo… |
CVE-2025-20982 | Medium | 6.4 | 2025-07-08 | Out-of-bounds write in setting auth secret in KnoxVault trustlet prior to SMR Jul-2025 Release 1 allows local privileged attackers to write out-of-bounds memor… |
CVE-2025-20996 | Medium | 5.0 | 2025-06-04 | Improper authorization in Smart Switch installed on non-Samsung Device prior to version 3.7.64.10 allows local attackers to read data with the privilege of Sma… |
CVE-2025-20995 | Medium | 4.9 | 2025-06-04 | Improper handling of insufficient permission in ClientProvider in Samsung Internet installed on non-Samsung Device prior to version 28.0.0.59 allows local atta… |
CVE-2025-20994 | Medium | 4.5 | 2025-06-04 | Improper handling of insufficient permission in SyncClientProvider in Samsung Internet installed on non-Samsung Device prior to version 28.0.0.59 allows local… |
CVE-2025-20993 | Medium | 4.0 | 2025-06-04 | Out-of-bounds write in libsecimaging.camera.samsung.so prior to SMR Jun-2025 Release 1 allows local attackers to write out-of-bounds memory. |
CVE-2025-20992 | Medium | 4.0 | 2025-06-04 | Out-of-bound read in libsecimaging.camera.samsung.so prior to SMR Feb-2025 Release 1 allows local attackers to read out-of-bounds memory. |
CVE-2025-20991 | Medium | 4.0 | 2025-06-04 | Improper export of Android application components in Bluetooth prior to SMR Jun-2025 Release 1 allows local attackers to make devices discoverable. |
CVE-2025-20989 | Medium | 5.2 | 2025-06-04 | Improper logging in fingerprint trustlet prior to SMR May-2025 Release 1 allows local privileged attackers to get a hmac_key. |
CVE-2025-20988 | Medium | 5.5 | 2025-06-04 | Out-of-bounds read in fingerprint trustlet prior to SMR May-2025 Release 1 allows local privileged attackers to read out-of-bounds memory. |
CVE-2025-20987 | Medium | 5.2 | 2025-06-04 | Improper access control in fingerprint trustlet prior to SMR May-2025 Release 1 allows local privileged attackers to get a auth_token. |
CVE-2025-20986 | Medium | 5.5 | 2025-06-04 | Improper access control in ScreenCapture for Galaxy Watch prior to SMR Jun-2025 Release 1 allows local attackers to take screenshots. |
CVE-2025-20985 | Medium | 5.5 | 2025-06-04 | Improper privilege management in ThemeManager prior to SMR Jun-2025 Release 1 allows local privileged attackers to reuse trial items. |
CVE-2025-20984 | Medium | 6.8 | 2025-06-04 | Incorrect default permission in Samsung Cloud for Galaxy Watch prior to SMR Jun-2025 Release 1 allows local attackers to access data in Samsung Cloud for Galax… |
CVE-2025-20981 | Medium | 6.2 | 2025-06-04 | Improper access control in AudioService prior to SMR Jun-2025 Release 1 allows local attackers to access sensitive information. |
CVE-2025-20980 | Medium | 4.0 | 2025-05-07 | Out-of-bounds write in libsavscmn prior to Android 15 allows local attackers to cause memory corruption. |
CVE-2025-20979 | High | 8.4 | 2025-05-07 | Out-of-bounds write in libsavscmn prior to Android 15 allows local attackers to execute arbitrary code. |
CVE-2025-20978 | Medium | 6.2 | 2025-05-07 | Improper access control in PENUP prior to version 3.9.19.32 allows local attackers to access files with PENUP privilege. |
CVE-2025-20977 | Low | 3.3 | 2025-05-07 | Use of implicit intent for sensitive communication in translation in Samsung Notes prior to version 4.4.29.23 allows local attackers to get sensitive informati… |
CVE-2025-20976 | Medium | 5.5 | 2025-05-07 | Out-of-bounds read in applying binary of text content in Samsung Notes prior to version 4.4.29.23 allows attackers to read out-of-bounds memory. |
CVE-2025-20975 | Medium | 5.5 | 2025-05-07 | Improper Export of Android Application Components in AODService prior to version 8.8.28.12 allows local attackers to launch arbitrary activity with systemui pr… |
CVE-2025-20974 | Medium | 6.1 | 2025-05-07 | Improper handling of insufficient permission in PackageInstallerCN prior to version 15.0.11.0 allows local attacker to bypass user interaction for requested in… |
CVE-2025-20973 | Medium | 5.4 | 2025-05-07 | Improper authentication in Secure Folder prior to version 1.8.12.0 in Android 13, and 1.9.21.00 in Android 14 allows physical attackers to reset the lock type… |
CVE-2025-20972 | Medium | 6.2 | 2025-05-07 | Improper verification of intent by broadcast receiver in Samsung Flow prior to version 4.9.17.6 allows local attackers to modify Samsung Flow configuration. |
CVE-2025-20971 | Medium | 5.5 | 2025-05-07 | Improper input validation in Samsung Flow prior to version 4.9.17.6 allows local attackers to access data within Samsung Flow. |
CVE-2025-20970 | Medium | 6.2 | 2025-05-07 | Improper access control in Bixby Vision prior to version 3.8.1 in Android 13, 3.8.3 in Android 14, 3.8.21 in Android 15 allows local attackers to access image… |
CVE-2025-20969 | Medium | 5.5 | 2025-05-07 | Improper input validation in Samsung Gallery prior to version 14.5.10.3 in Global Android 13, 14.5.09.3 in China Android 13, and 15.5.04.5 in Android 14 allows… |
CVE-2025-20968 | High | 7.2 | 2025-05-07 | Improper access control in Samsung Gallery prior to version 14.5.10.3 in Global Android 13, 14.5.09.3 in China Android 13, and 15.5.04.5 in Android 14 allows r… |
CVE-2025-20967 | Medium | 5.1 | 2025-05-07 | Improper access control in Samsung Gallery prior to version 14.5.10.3 in Global Android 13, 14.5.09.3 in China Android 13, and 15.5.04.5 in Android 14 allows a… |
CVE-2025-20966 | Medium | 4.6 | 2025-05-07 | Improper access control in Samsung Gallery prior to version 14.5.10.3 in Global Android 13, 14.5.09.3 in China Android 13, and 15.5.04.5 in Android 14 allows p… |
CVE-2025-20965 | Medium | 6.2 | 2025-05-07 | Improper handling of insufficient permission in Bixby wakeup prior to version 2.3.74.8 allows local attackers to access sensitive data. |
CVE-2025-20964 | Medium | 6.6 | 2025-05-07 | Out-of-bounds write in parsing media files in libsavsvc.so prior to SMR May-2025 Release 1 allows local attackers to write out-of-bounds memory. |
CVE-2025-20963 | Medium | 6.6 | 2025-05-07 | Out-of-bounds write in memory initialization in libsavsvc.so prior to SMR May-2025 Release 1 allows local attackers to write out-of-bounds memory. |
CVE-2025-20962 | Medium | 4.0 | 2025-05-07 | Improper handling of insufficient permission in SpenGesture service prior to SMR May-2025 Release 1 allows local attackers to track the S Pen position. |
CVE-2025-20961 | Medium | 5.5 | 2025-05-07 | Improper handling of insufficient permission or privileges in sepunion service prior to SMR May-2025 Release 1 allows local privileged attackers to access file… |
CVE-2025-20960 | Medium | 4.0 | 2025-05-07 | Improper handling of insufficient permission in CocktailBarService prior to SMR May-2025 Release 1 allows local attackers to use the privileged api. |
CVE-2025-20959 | Medium | 5.1 | 2025-05-07 | Use of implicit intent for sensitive communication in Wi-Fi P2P service prior to SMR May-2025 Release 1 allows local attackers to access sensitive information. |
CVE-2025-20958 | Medium | 4.4 | 2025-05-07 | Improper verification of intent by broadcast receiver in UnifiedWFC prior to SMR May-2025 Release 1 allows local attackers to manipulate VoWiFi related behavio… |
CVE-2025-20957 | High | 7.3 | 2025-05-07 | Improper access control in SmartManagerCN prior to SMR May-2025 Release 1 allows local attackers to launch arbitrary activities with SmartManagerCN privilege. |
CVE-2025-20956 | Medium | 4.3 | 2025-05-07 | Improper export of android application components in Settings in Galaxy Watch prior to SMR May-2025 Release 1 allows physical attackers to access developer set… |
CVE-2025-20955 | Medium | 5.5 | 2025-05-07 | Improper Export of Android Application Components in NotificationHistoryImageProvider prior to SMR May-2025 Release 1 allows local attackers to access notifica… |
CVE-2025-20954 | Medium | 5.5 | 2025-05-07 | Use of implicit intent for sensitive communication in EnrichedCall prior to SMR May-2025 Release 1 allows local attackers to access sensitive information. User… |
CVE-2025-20953 | Medium | 5.1 | 2025-05-07 | Improper access control in SmartManagerCN prior to SMR May-2025 Release 1 allows local attackers to launch activities within SmartManagerCN. |
CVE-2025-20949 | Medium | 5.1 | 2025-05-07 | Path traversal vulnerability in Samsung Members prior to version 5.0.00.11 allows attackers to read and write arbitrary file with the privilege of Samsung Memb… |
CVE-2025-20937 | Medium | 6.7 | 2025-05-07 | Out-of-bounds write in Keymaster trustlet prior to SMR May-2025 Release 1 allows local privileged attackers to write out-of-bounds memory. |
CVE-2025-20952 | Medium | 5.5 | 2025-04-09 | Improper access control in Mdecservice prior to SMR Apr-2025 Release 1 allows local attackers to access arbitrary files with system privilege. |
CVE-2025-20951 | Medium | 5.1 | 2025-04-08 | Improper verification of intent by broadcast receiver vulnerability in Galaxy Store prior to version 4.5.90.7 allows local attackers to write arbitrary files w… |
CVE-2025-20950 | Medium | 4.0 | 2025-04-08 | Use of implicit intent for sensitive communication in SamsungNotes prior to version 4.4.26.45 allows local attackers to access sensitive information. |
CVE-2025-20948 | Medium | 5.5 | 2025-04-08 | Out-of-bounds read in enrollment with cdsp frame secfr trustlet prior to SMR Apr-2025 Release 1 allows local privileged attackers to read out-of-bounds memory. |
CVE-2025-20947 | Medium | 5.5 | 2025-04-08 | Improper handling of insufficient permission or privileges in ClipboardService prior to SMR Apr-2025 Release 1 allows local attackers to access image files acr… |
CVE-2025-20946 | High | 8.8 | 2025-04-08 | Improper handling of exceptional conditions in pairing specific bluetooth devices in Galaxy Watch Bluetooth pairing prior to SMR Apr-2025 Release 1 allows loca… |
CVE-2025-20945 | Medium | 4.0 | 2025-04-08 | Improper access control in Galaxy Watch prior to SMR Apr-2025 Release 1 allows local attackers to access sensitive information of Galaxy watch. |
CVE-2025-20944 | Medium | 6.2 | 2025-04-08 | Out-of-bounds read in parsing audio data in libsavsac.so prior to SMR Apr-2025 Release 1 allows local attackers to read out-of-bounds memory. |
CVE-2025-20943 | Medium | 6.4 | 2025-04-08 | Out-of-bounds write in secfr trustlet prior to SMR Apr-2025 Release 1 allows local privileged attackers to cause memory corruption. |
CVE-2025-20942 | Medium | 4.4 | 2025-04-08 | Improper Verification of Intent by Broadcast Receiver in DeviceIdService prior to SMR Apr-2025 Release 1 allows local attackers to reset OAID. |
CVE-2025-20941 | Medium | 6.2 | 2025-04-08 | Improper access control in InputManager to SMR Apr-2025 Release 1 allows local attackers to access the scancode of specific input device. |
CVE-2025-20940 | Medium | 4.0 | 2025-04-08 | Improper handling of insufficient permission in Samsung Device Health Manager Service prior to SMR Apr-2025 Release 1 allows local attackers to access provider… |
CVE-2025-20939 | Medium | 5.4 | 2025-04-08 | Improper authorization in wireless download protocol in Galaxy Watch prior to SMR Apr-2025 Release 1 allows physical attackers to update device unique identifi… |
CVE-2025-20938 | Medium | 5.5 | 2025-04-08 | Improper access control in SamsungContacts prior to SMR Apr-2025 Release 1 allows local attackers to access protected data in SamsungContacts. |
CVE-2025-20936 | High | 8.8 | 2025-04-08 | Improper access control in HDCP trustlet prior to SMR Apr-2025 Release 1 allows local attackers with shell privilege to escalate their privileges to root. |
CVE-2025-20935 | Medium | 5.5 | 2025-04-08 | Improper handling of insufficient permission or privileges in ClipboardService prior to SMR Apr-2025 Release 1 allows local attackers to access files with syst… |
CVE-2025-20934 | Medium | 5.5 | 2025-04-08 | Improper access control in Sticker Center prior to SMR Apr-2025 Release 1 allows local attackers to access image files with system privilege. |
CVE-2025-20933 | Medium | 5.5 | 2025-03-06 | Out-of-bounds read in parsing bmp image in Samsung Notes prior to version 4.4.26.71 allows local attackers to read out-of-bounds memory. |
CVE-2025-20932 | Medium | 5.5 | 2025-03-06 | Out-of-bounds read in parsing rle of bmp image in Samsung Notes prior to version 4.4.26.71 allows local attackers to혻read out-of-bounds memory. |