Samsung Mobile
Page 4 of 14 — Samsung Mobile CVEs from a corpus of 1362, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-20931 | High | 7.3 | 2025-03-06 | Out-of-bounds write in parsing bmp image in Samsung Notes prior to version 4.4.26.71 allows local attackers to execute arbitrary code. |
CVE-2025-20930 | Medium | 5.5 | 2025-03-06 | Out-of-bounds read in parsing jpeg image in Samsung Notes prior to version 4.4.26.71 allows local attackers to read out-of-bounds memory. |
CVE-2025-20929 | High | 7.3 | 2025-03-06 | Out-of-bounds write in parsing jpeg image in Samsung Notes prior to version 4.4.26.71 allows local attackers to execute arbitrary code. |
CVE-2025-20928 | Medium | 5.5 | 2025-03-06 | Out-of-bounds read in parsing wbmp image in Samsung Notes prior to vaersion 4.4.26.71 allows local attackers to access out-of-bounds memory. |
CVE-2025-20927 | Medium | 5.5 | 2025-03-06 | Out-of-bounds read in parsing image data in Samsung Notes prior to vaersion 4.4.26.71 allows local attackers to access out-of-bounds memory. |
CVE-2025-20926 | Medium | 5.5 | 2025-03-06 | Improper export of Android application components in My Files prior to version 15.0.07.5 in Android 14 allows local attackers to access files with My Files' pr… |
CVE-2025-20925 | Medium | 5.5 | 2025-03-06 | Out-of-bounds read in applying binary of text data in Samsung Notes prior to version 4.4.26.71 allows local attackers to potentially read memory. |
CVE-2025-20924 | Medium | 4.6 | 2025-03-06 | Improper access control in Samsung Notes prior to version 4.4.26.71 allows physical attackers to access data across multiple user profiles. |
CVE-2025-20923 | Medium | 4.0 | 2025-03-06 | Improper access control in Galaxy Wearable prior to version 2.2.61.24112961 allows local attackers to launch arbitrary activity with Galaxy Wearable privilege. |
CVE-2025-20922 | Medium | 5.5 | 2025-03-06 | Out-of-bounds read in appending text paragraph in Samsung Notes prior to version 4.4.26.71 allows attackers to read out-of-bounds memory. |
CVE-2025-20921 | Medium | 5.5 | 2025-03-06 | Out-of-bounds read in applying binary of text content in Samsung Notes prior to version 4.4.26.71 allows attackers to read out-of-bounds memory. |
CVE-2025-20920 | Medium | 5.5 | 2025-03-06 | Out-of-bounds read in action link data in Samsung Notes prior to version 4.4.26.71 allows attackers to read out-of-bounds memory. |
CVE-2025-20919 | Medium | 5.5 | 2025-03-06 | Out-of-bounds read in applying binary of video content in Samsung Notes prior to version 4.4.26.71 allows attackers to read out-of-bounds memory. |
CVE-2025-20918 | Medium | 5.5 | 2025-03-06 | Out-of-bounds read in applying extra data of base content in Samsung Notes prior to version 4.4.26.71 allows attackers to read out-of-bounds memory. |
CVE-2025-20917 | Medium | 5.5 | 2025-03-06 | Out-of-bounds read in applying binary of pdf content in Samsung Notes prior to version 4.4.26.71 allows attackers to read out-of-bounds memory. |
CVE-2025-20916 | Medium | 5.5 | 2025-03-06 | Out-of-bounds read in reading string of SPen in Samsung Notes prior to version 4.4.26.71 allows attackers to read out-of-bounds memory. |
CVE-2025-20915 | Medium | 5.5 | 2025-03-06 | Out-of-bounds read in applying binary of voice content in Samsung Notes prior to version 4.4.26.71 allows attackers to read out-of-bounds memory. |
CVE-2025-20914 | Medium | 5.5 | 2025-03-06 | Out-of-bounds read in applying binary of hand writing content in Samsung Notes prior to version 4.4.26.71 allows attackers to read out-of-bounds memory. |
CVE-2025-20913 | Medium | 5.5 | 2025-03-06 | Out-of-bounds read in applying binary of drawing content in Samsung Notes prior to version 4.4.26.71 allows attackers to read out-of-bounds memory. |
CVE-2025-20912 | Medium | 6.2 | 2025-03-06 | Incorrect default permission in DiagMonAgent prior to SMR Mar-2025 Release 1 allows local attackers to access data within Galaxy Watch. |
CVE-2025-20911 | Medium | 4.4 | 2025-03-06 | Improper access control in sem_wifi service prior to SMR Mar-2025 Release 1 allows privileged local attackers to update MAC address of Galaxy Watch. |
CVE-2025-20910 | Medium | 6.2 | 2025-03-06 | Incorrect default permission in Galaxy Watch Gallery prior to SMR Mar-2025 Release 1 allows local attackers to access data in Galaxy Watch Gallery. |
CVE-2025-20909 | Medium | 4.0 | 2025-03-06 | Use of implicit intent for sensitive communication in Settings prior to SMR Mar-2025 Release 1 allows local attackers to access sensitive information. |
CVE-2025-20908 | Medium | 6.5 | 2025-03-06 | Use of insufficiently random values in Auracast prior to SMR Mar-2025 Release 1 allows adjacent attackers to access Auracast broadcasting. |
CVE-2025-20903 | High | 7.3 | 2025-03-06 | Improper access control in SecSettingsIntelligence prior to SMR Mar-2025 Release 1 allows local attackers to launch privileged activities. User interaction is… |
CVE-2025-20907 | Medium | 6.0 | 2025-02-04 | Improper privilege management in Samsung Find prior to SMR Feb-2025 Release 1 allows local privileged attackers to disable Samsung Find. |
CVE-2025-20906 | Medium | 5.5 | 2025-02-04 | Improper Export of Android Application Components in Settings prior to SMR Feb-2025 Release 1 allows local attackers to enable ADB. |
CVE-2025-20905 | Medium | 6.3 | 2025-02-04 | Out-of-bounds read and write in mPOS TUI trustlet prior to SMR Feb-2025 Release 1 allows local privileged attackers to read and write out-of-bounds memory. |
CVE-2025-20904 | Medium | 6.3 | 2025-02-04 | Out-of-bounds write in mPOS TUI trustlet prior to SMR Feb-2025 Release 1 allows local privileged attackers to cause memory corruption. |
CVE-2025-20902 | Medium | 5.1 | 2025-02-04 | Improper access control in Media Controller prior to version 1.0.24.5282 allows local attacker to launch activities in MediaController's privilege. |
CVE-2025-20901 | Medium | 4.4 | 2025-02-04 | Out-of-bounds read in Blockchain Keystore prior to version 1.3.16.5 allows local privileged attackers to read out-of-bounds memory. |
CVE-2025-20900 | Medium | 6.3 | 2025-02-04 | Out-of-bounds write in Blockchain Keystore prior to version 1.3.16.5 allows local privileged attackers to write out-of-bounds memory. |
CVE-2025-20899 | Medium | 4.0 | 2025-02-04 | Improper access control in PushNotification prior to version 13.0.00.15 in Android 12, 14.0.00.7 in Android 13, and 15.1.00.5 in Android 14 allows local attack… |
CVE-2025-20898 | Medium | 4.6 | 2025-02-04 | Improper input validation in Samsung Members prior to version 5.2.00.12 allows physical attackers to access data across multiple user profiles. |
CVE-2025-20897 | Medium | 6.8 | 2025-02-04 | Improper access control in Secure Folder prior to version 1.9.20.50 in Android 14, 1.8.11.0 in Android 13, and 1.7.04.0 in Android 12 allows local attacker to… |
CVE-2025-20896 | Medium | 4.0 | 2025-02-04 | Use of implicit intent for sensitive communication in EasySetup prior to version 11.1.18 allows local attackers to access sensitive information. |
CVE-2025-20895 | Low | 3.2 | 2025-02-04 | Authentication Bypass Using an Alternate Path in Galaxy Store prior to version 4.5.87.6 allows physical attackers to install arbitrary applications to bypass r… |
CVE-2025-20894 | Medium | 4.6 | 2025-02-04 | Improper access control in Samsung Email prior to version 6.1.97.1 allows physical attackers to access data across multiple user profiles. |
CVE-2025-20893 | Medium | 5.1 | 2025-02-04 | Improper access control in NotificationManager prior to SMR Jan-2025 Release 1 allows local attackers to change the configuration of notifications. |
CVE-2025-20892 | Medium | 5.9 | 2025-02-04 | Protection Mechanism Failure in bootloader prior to SMR Jan-2025 Release 1 allows physical attackers to allow to execute fastboot command. User interaction is… |
CVE-2025-20891 | Medium | 5.3 | 2025-02-04 | Out-of-bounds read in decoding malformed bitstream of video thumbnails in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attackers to read arbitrary… |
CVE-2025-20890 | High | 7.0 | 2025-02-04 | Out-of-bounds write in decoding frame buffer in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attackers to execute arbitrary code with privilege. U… |
CVE-2025-20889 | Medium | 5.3 | 2025-02-04 | Out-of-bounds read in decoding malformed bitstream for smp4vtd in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attackers to read arbitrary memory… |
CVE-2025-20888 | High | 7.0 | 2025-02-04 | Out-of-bounds write in handling the block size for smp4vtd in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attackers to execute arbitrary code wit… |
CVE-2025-20887 | Medium | 5.3 | 2025-02-04 | Out-of-bounds read in accessing table used for svp8t in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attackers to read arbitrary memory. User inte… |
CVE-2025-20886 | Medium | 4.1 | 2025-02-04 | Inclusion of sensitive information in test code in softsim trustlet prior to SMR Jan-2025 Release 1 allows local privileged attackers to get test key. |
CVE-2025-20885 | Medium | 6.4 | 2025-02-04 | Out-of-bounds write in softsim trustlet prior to SMR Jan-2025 Release 1 allows local privileged attackers to cause memory corruption. |
CVE-2025-20884 | Medium | 4.6 | 2025-02-04 | Improper access control in Samsung Message prior to SMR Jan-2025 Release 1 allows physical attackers to access data across multiple user profiles. |
CVE-2025-20883 | Medium | 4.6 | 2025-02-04 | Improper access control in SoundPicker prior to SMR Jan-2025 Release 1 allows physical attackers to access data across multiple user profiles. |
CVE-2025-20882 | High | 7.0 | 2025-02-04 | Out-of-bounds write in accessing uninitialized memory for svc1td in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attackers to execute arbitrary co… |
CVE-2025-20881 | High | 7.0 | 2025-02-04 | Out-of-bounds write in accessing buffer storing the decoded video frames in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attackers to execute arbi… |
CVE-2024-49422 | Medium | 5.2 | 2024-12-31 | Protection Mechanism Failure in bootloader prior to SMR Oct-2024 Release 1 allows physical attackers to reset lockscreen failure count by hardware fault inject… |
CVE-2024-49421 | Medium | 4.3 | 2024-12-03 | Path traversal in Quick Share Agent prior to version 3.5.14.47 in Android 12, 3.5.19.41 in Android 13, and 3.5.19.42 in Android 14 allows adjacent attackers to… |
CVE-2024-49420 | High | 7.5 | 2024-12-03 | Improper handling of responses in GamingHub prior to version 6.1.04.6 in Korea, 7.1.03.7 in Global allows remote attackers to launch arbitrary activity. |
CVE-2024-49419 | Medium | 4.3 | 2024-12-03 | Insufficient verification of url authenticity in GamingHub prior to version 6.1.03.4 in Korea, 7.1.02.4 in Global allows remote attackers to load an arbitrary… |
CVE-2024-49418 | Medium | 6.5 | 2024-12-03 | Insufficient verification of url authenticity in GamingHub prior to version 6.1.03.4 in Korea, 7.1.02.4 in Global allows remote attackers to enable JavaScript… |
CVE-2024-49417 | Low | 2.0 | 2024-12-03 | Use of implicit intent for sensitive communication in Smart Touch Call prior to 1.0.0.8 allows local attackers to launch privileged activities. User interactio… |
CVE-2024-49416 | Medium | 4.0 | 2024-12-03 | Use of implicit intent for sensitive communication in SmartThings prior to version 1.8.21 allows local attackers to get sensitive information. |
CVE-2024-49415 | High | 8.1 | 2024-12-03 | Out-of-bound write in libsaped.so prior to SMR Dec-2024 Release 1 allows remote attackers to execute arbitrary code. |
CVE-2024-49414 | Low | 2.4 | 2024-12-03 | Authentication Bypass Using an Alternate Path in Dex Mode prior to SMR Dec-2024 Release 1 allows physical attackers to temporarily access to recent app list. |
CVE-2024-49413 | High | 7.1 | 2024-12-03 | Improper Verification of Cryptographic Signature in SmartSwitch prior to SMR Dec-2024 Release 1 allows local attackers to install malicious applications. |
CVE-2024-49412 | Medium | 5.5 | 2024-12-03 | Improper input validation in Settings prior to SMR Dec-2024 Release 1 allows local attackers to broadcast signal for discovering Bluetooth on Galaxy Watch. |
CVE-2024-49411 | Medium | 4.3 | 2024-12-03 | Path Traversal in ThemeCenter prior to SMR Dec-2024 Release 1 allows physical attackers to copy apk files to arbitrary path with ThemeCenter privilege. |
CVE-2024-49410 | Medium | 5.9 | 2024-12-03 | Out-of-bounds write in libswmfextractor.so prior to SMR Dec-2024 Release 1 allows local attackers to execute arbitrary code. |
CVE-2024-49409 | Medium | 6.4 | 2024-11-06 | Out-of-bounds write in Battery Full Capacity node prior to Firmware update Sep-2024 Release on Galaxy S24 allows local attackers to write out-of-bounds memory… |
CVE-2024-49408 | Medium | 6.4 | 2024-11-06 | Out-of-bounds write in usb driver prior to Firmware update Sep-2024 Release on Galaxy S24 allows local attackers to write out-of-bounds memory. System privileg… |
CVE-2024-49407 | Medium | 4.6 | 2024-11-06 | Improper access control in Samsung Flow prior to version 4.9.15.7 allows physical attackers to access data across multiple user profiles. |
CVE-2024-49406 | Medium | 6.7 | 2024-11-06 | Improper validation of integrity check value in Blockchain Keystore prior to version 1.3.16 allows local attackers to modify transaction. Root privilege is req… |
CVE-2024-49405 | Medium | 5.3 | 2024-11-06 | Improper authentication in Private Info in Samsung Pass in prior to version 4.4.04.7 allows physical attackers to access sensitive information in a specific sc… |
CVE-2024-49404 | Medium | 5.5 | 2024-11-06 | Improper Access Control in Samsung Video Player prior to versions 7.3.29.1 in Android 12, 7.3.36.1 in Android 13, and 7.3.41.230 in Android 14 allows physical… |
CVE-2024-49403 | Medium | 4.6 | 2024-11-06 | Improper access control in Samsung Voice Recorder prior to version 21.5.40.37 allows physical attackers to access recording files on the lock screen. |
CVE-2024-49402 | Medium | 4.6 | 2024-11-06 | Improper input validation in Dressroom prior to SMR Nov-2024 Release 1 allow physical attackers to access data across multiple user profiles. |
CVE-2024-49401 | Medium | 5.1 | 2024-11-06 | Improper input validation in Settings Suggestions prior to SMR Nov-2024 Release 1 allows local attackers to launch privileged activities. |
CVE-2024-34682 | Low | 2.4 | 2024-11-06 | Improper authorization in Settings prior to SMR Nov-2024 Release 1 allows physical attackers to access stored WiFi password in Maintenance Mode. |
CVE-2024-34681 | Medium | 6.6 | 2024-11-06 | Improper input validation in BluetoothAdapter prior to SMR Nov-2024 Release 1 allows local attackers to cause local permanent denial of service on Galaxy Watch. |
CVE-2024-34680 | Medium | 4.0 | 2024-11-06 | Use of implicit intent for sensitive communication in WlanTest prior to SMR Nov-2024 Release 1 allows local attackers to get sensitive information. |
CVE-2024-34679 | Medium | 4.0 | 2024-11-06 | Incorrect default permissions in Crane prior to SMR Nov-2024 Release 1 allows local attackers to access files with phone privilege. |
CVE-2024-34678 | Medium | 5.9 | 2024-11-06 | Out-of-bounds write in libsapeextractor.so prior to SMR Nov-2024 Release 1 allows local attackers to cause memory corruption. |
CVE-2024-34677 | Medium | 4.0 | 2024-11-06 | Exposure of sensitive information in System UI prior to SMR Nov-2024 Release 1 allow local attackers to make malicious apps appear as legitimate. |
CVE-2024-34676 | Medium | 4.4 | 2024-11-06 | Out-of-bounds write in parsing subtitle file in libsubextractor.so prior to SMR Nov-2024 Release 1 allows local attackers to cause memory corruption. User inte… |
CVE-2024-34675 | Low | 2.4 | 2024-11-06 | Improper access control in Dex Mode prior to SMR Nov-2024 Release 1 allows physical attackers to temporarily access to unlocked screen. |
CVE-2024-34674 | Medium | 4.6 | 2024-11-06 | Improper access control in Contacts prior to SMR Nov-2024 Release 1 allows physical attackers to access data across multiple user profiles. |
CVE-2024-34673 | Medium | 4.1 | 2024-11-06 | Improper Input Validation in IpcProtocol in Modem prior to SMR Nov-2024 Release 1 allows local attackers to cause Denial-of-Service. |
CVE-2024-34672 | Medium | 5.5 | 2024-10-08 | Improper input validation in SamsungVideoPlayer prior to versions 7.3.29.1 in Android 12, 7.3.36.1 in Android 13, and 7.3.41.230 in Android 14 allows local att… |
CVE-2024-34671 | Low | 3.3 | 2024-10-08 | Use of implicit intent for sensitive communication in translation혻in Samsung Internet prior to version 26.0.3.1 allows local attackers to get sensitive informa… |
CVE-2024-34670 | Medium | 4.0 | 2024-10-08 | Use of implicit intent for sensitive communication in Sound Assistant prior to version 6.1.0.9 allows local attackers to get sensitive information. |
CVE-2024-34669 | High | 7.5 | 2024-10-08 | Out-of-bounds write in parsing h.263+ format in librtppayload.so prior to SMR Oct-2024 Release 1 allows remote attackers to execute arbitrary code with system… |
CVE-2024-34668 | High | 7.5 | 2024-10-08 | Out-of-bounds write in parsing h.263 format in librtppayload.so prior to SMR Oct-2024 Release 1 allows remote attackers to execute arbitrary code with system p… |
CVE-2024-34667 | High | 7.5 | 2024-10-08 | Out-of-bounds write in parsing h.265 format in librtppayload.so prior to SMR Oct-2024 Release 1 allows remote attackers to execute arbitrary code with system p… |
CVE-2024-34666 | High | 7.5 | 2024-10-08 | Out-of-bounds write in parsing h.264 format in a specific mode in librtppayload.so prior to SMR Oct-2024 Release 1 allows remote attackers to execute arbitrary… |
CVE-2024-34665 | High | 7.5 | 2024-10-08 | Out-of-bounds write in parsing h.264 format in librtppayload.so prior to SMR Oct-2024 Release 1 allows remote attackers to execute arbitrary code with system p… |
CVE-2024-34664 | Medium | 4.1 | 2024-10-08 | Improper check for exception conditions in Knox Guard prior to SMR Oct-2024 Release 1 allows physical attackers to bypass Knox Guard in a multi-user environmen… |
CVE-2024-34663 | Medium | 5.3 | 2024-10-08 | Integer overflow in libSEF.quram.so prior to SMR Oct-2024 Release 1 allows local attackers to write out-of-bounds memory. |
CVE-2024-34662 | Medium | 6.2 | 2024-10-08 | Improper access control in ActivityManager prior to SMR Oct-2024 Release 1 in select Android 12, 13 and SMR Sep-2024 Release 1 in select Android 14 allows loca… |
CVE-2024-34661 | Medium | 4.3 | 2024-09-04 | Improper handling of insufficient permissions in Samsung Assistant prior to version 9.1.00.7 allows remote attackers to access location data. User interaction… |
CVE-2024-34660 | High | 7.3 | 2024-09-04 | Heap-based out-of-bounds write in Samsung Notes prior to version 4.4.21.62 allows local attackers to execute arbitrary code. |
CVE-2024-34659 | High | 7.5 | 2024-09-04 | Exposure of sensitive information in GroupSharing prior to version 13.6.13.3 allows remote attackers can force the victim to join the group. |
CVE-2024-34658 | Medium | 4.0 | 2024-09-04 | Out-of-bounds read in Samsung Notes allows local attackers to bypass ASLR. |
CVE-2024-34657 | High | 8.6 | 2024-09-04 | Stack-based out-of-bounds write in Samsung Notes prior to version 4.4.21.62 allows remote attackers to execute arbitrary code. |
CVE-2024-34656 | High | 7.3 | 2024-09-04 | Path traversal in Samsung Notes prior to version 4.4.21.62 allows local attackers to execute arbitrary code. |