Samsung
Page 3 of 17 — Samsung CVEs from a corpus of 1634, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-21046 | Low | 2.4 | 2025-10-10 | Improper access control in WindowManager in Samsung DeX prior to SMR Oct-2025 Release 1 allows physical attackers to temporarily access to recent app list. |
CVE-2025-21045 | Medium | 4.0 | 2025-10-10 | Insecure storage of sensitive information in Galaxy Watch prior to SMR Oct-2025 Release 1 allows local attackers to access sensitive information. |
CVE-2025-21044 | Medium | 5.7 | 2025-10-10 | Out-of-bounds write in fingerprint trustlet prior to SMR Oct-2025 Release 1 allows local privileged attackers to write out-of-bounds memory. |
CVE-2025-21043 | High | 8.8 | 2025-09-12 | Out-of-bounds write in libimagecodec.quram.so prior to SMR Sep-2025 Release 1 allows remote attackers to execute arbitrary code. |
CVE-2025-21042 | High | 8.8 | 2025-09-12 | Out-of-bounds write in libimagecodec.quram.so prior to SMR Apr-2025 Release 1 allows remote attackers to execute arbitrary code. |
CVE-2024-34598 | High | 7.7 | 2025-09-04 | Improper export of component in GoodLock prior to version 2.2.04.95 allows local attackers to install arbitrary applications from Galaxy Store. |
CVE-2025-21041 | Medium | 6.2 | 2025-09-03 | Insecure Storage of Sensitive Information in Secure Folder prior to Android 16 allows local attackers to access sensitive information. |
CVE-2025-21040 | Medium | 5.1 | 2025-09-03 | Improper verification of intent by ExternalBroadcastReceiver in S Assistant prior to version 9.3.2 allows local attackers to modify itinerary information. |
CVE-2025-21039 | Medium | 5.1 | 2025-09-03 | Improper verification of intent by SystemExceptionalBroadcastReceiver in S Assistant prior to version 9.3.2 allows local attackers to modify itinerary informat… |
CVE-2025-21038 | Medium | 5.1 | 2025-09-03 | Improper verification of intent by SamsungExceptionalBroadcastReceiver in S Assistant prior to version 9.3.2 allows local attackers to modify itinerary informa… |
CVE-2025-21037 | Medium | 4.1 | 2025-09-03 | Improper access control in Samsung Notes prior to version 4.4.30.63 allows physical attackers to access data across multiple user profiles. User interaction is… |
CVE-2025-21036 | Medium | 5.0 | 2025-09-03 | Improper access control in Samsung Notes prior to version 4.4.30.63 allows local privileged attackers to access exported note files. User interaction is requir… |
CVE-2025-21035 | Medium | 4.6 | 2025-09-03 | Improper access control in Samsung Calendar prior to version 12.5.06.5 in Android 14 and 12.6.01.12 in Android 15 allows physical attackers to access data acro… |
CVE-2025-21034 | Medium | 4.0 | 2025-09-03 | Out-of-bounds write in libsavsvc.so prior to SMR Sep-2025 Release 1 allows local attackers to potentially execute arbitrary code. |
CVE-2025-21033 | Medium | 4.0 | 2025-09-03 | Improper access control in ContactProvider prior to SMR Sep-2025 Release 1 allows local attackers to access sensitive information. |
CVE-2025-21032 | Medium | 5.9 | 2025-09-03 | Improper access control in One UI Home prior to SMR Sep-2025 Release 1 allows physical attackers to bypass Kiosk mode under limited conditions. |
CVE-2025-21031 | Medium | 6.8 | 2025-09-03 | Improper access control in ImsService prior to SMR Sep-2025 Release 1 allows local attackers to use the privileged APIs. |
CVE-2025-21029 | Medium | 4.0 | 2025-09-03 | Improper handling of insufficient permission in System UI prior to SMR Sep-2025 Release 1 allows local attackers to send arbitrary replies to messages from the… |
CVE-2025-21028 | Medium | 5.5 | 2025-09-03 | Improper privilege management in ThemeManager prior to SMR Sep-2025 Release 1 allows local privileged attackers to reuse trial items. |
CVE-2025-21027 | Medium | 5.1 | 2025-09-03 | Improper verification of intent by broadcast receiver in ImsService prior to SMR Sep-2025 Release 1 allows local attackers to temporarily disable the SIM. |
CVE-2025-21026 | Medium | 4.0 | 2025-09-03 | Improper handling of insufficient permission in ImsService prior to SMR Sep-2025 Release 1 allows local attackers to interrupt the call. |
CVE-2025-21025 | Medium | 5.1 | 2025-09-03 | Improper access control in MARsExemptionManager prior to SMR Sep-2025 Release 1 allows local attackers to be excluded from background execution management. |
CVE-2023-21483 | Medium | 6.4 | 2025-09-03 | Improper Access Control vulnerability in Galaxy Store prior to version 4.5.53.6 allows local attacker to access protected data using exported service. |
CVE-2023-21482 | Medium | 6.1 | 2025-09-03 | Missing authorization vulnerability in Camera prior to versions 11.1.02.18 in Android 11, 12.1.03.8 in Android 12 and 13.1.01.4 in Android 13 allows physical… |
CVE-2023-21481 | Medium | 5.4 | 2025-09-03 | Improper URL input validation vulnerability in Samsung Account application prior to version 14.1.0.0 allows remote attackers to get sensitive information. |
CVE-2023-21480 | High | 8.5 | 2025-09-03 | Improper input validation vulnerability in CertByte prior to SMR Apr-2023 Release 1 allows local attackers to launch privileged activities. |
CVE-2023-21479 | Medium | 5.3 | 2025-09-03 | Improper authorization in Smart suggestions prior to SMR Apr-2023 Release 1 in Android 13 and 4.1.01.0 in Android 12 allows remote attackers to register a sche… |
CVE-2023-21478 | Medium | 6.0 | 2025-09-03 | Improper input validation vulnerability in TIGERF trustlet prior to SMR Apr-2023 Release 1 allows local attackers to access protected data. |
CVE-2023-21477 | High | 7.9 | 2025-09-03 | Access of Memory Location After End of Buffer vulnerability in TIGERF trustlet prior to SMR Apr-2023 Release 1 allows local attackers to access protected data. |
CVE-2023-21476 | High | 8.0 | 2025-09-03 | Out-of-bounds Write vulnerability in libaudiosaplus_sec.so library prior to SMR Apr-2023 Release 1 allows local attacker to execute arbitrary code. |
CVE-2023-21475 | High | 8.0 | 2025-09-03 | Out-of-bounds Write vulnerability in libaudiosaplus_sec.so library prior to SMR Apr-2023 Release 1 allows local attacker to execute arbitrary code. |
CVE-2023-21474 | Medium | 6.3 | 2025-09-03 | Intent redirection vulnerability in SecSettings prior to SMR Apr-2022 Release 1 allows attackers to access arbitrary file with system privilege. |
CVE-2023-21473 | Medium | 6.8 | 2025-09-03 | Improper input validation with Exynos Fastboot USB Interface prior to SMR Apr-2023 Release 1 allows a physical attacker to execute arbitrary code in bootloader. |
CVE-2023-21472 | Medium | 6.8 | 2025-09-03 | Improper input validation with Exynos Fastboot USB Interface prior to SMR Apr-2023 Release 1 allows a physical attacker to execute arbitrary code in bootloader. |
CVE-2023-21471 | Medium | 4.0 | 2025-09-03 | Improper access control vulnerability in SemClipboard prior to SMR Apr-2023 Release 1 allows attackers to read arbitrary files with system permission. |
CVE-2023-21470 | Medium | 4.0 | 2025-09-03 | Improper access control vulnerability in SLocation prior to SMR Apr-2022 Release 1 allows local attackers to get device location information using com.samsung… |
CVE-2023-21469 | Medium | 4.0 | 2025-09-03 | Improper access control vulnerability in SLocation prior to SMR Apr-2022 Release 1 allows local attackers to get device location information using com.samsung… |
CVE-2023-21468 | Medium | 5.9 | 2025-09-03 | Improper access control vulnerability in Telephony prior to SMR Apr-2023 Release 1 allows attackers to access files with escalated permission. |
CVE-2023-21467 | Medium | 4.6 | 2025-09-03 | Error in 3GPP specification implementation in Exynos baseband prior to SMR Apr-2023 Release 1 allows incorrect handling of unencrypted message. |
CVE-2023-21466 | Medium | 5.3 | 2025-09-03 | PendingIntent hijacking vulnerability in CertificatePolicy in framework prior to SMR Apr-2023 Release 1 allows local attackers to access contentProvider withou… |
CVE-2025-32100 | Medium | 6.5 | 2025-09-02 | An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580… |
CVE-2025-32098 | Medium | 5.3 | 2025-09-02 | An issue was discovered in Samsung Magician 6.3 through 8.3 on Windows. An attacker can achieve Elevation of Privileges to SYSTEM by exploiting insecure file d… |
CVE-2025-21022 | Low | 3.3 | 2025-08-06 | Improper access control in Galaxy Wearable prior to version 2.2.63.25042861 allows local attackers to access sensitive information. |
CVE-2025-21021 | Medium | 5.7 | 2025-08-06 | Out-of-bounds write in drawing pinpad in Blockchain Keystore prior to version 1.3.17.2 allows local privileged attackers to write out-of-bounds memory. |
CVE-2025-21020 | Medium | 5.7 | 2025-08-06 | Out-of-bounds write in creating bitmap images in Blockchain Keystore prior to version 1.3.17.2 allows local privileged attackers to write out-of-bounds memory. |
CVE-2025-21019 | Medium | 5.5 | 2025-08-06 | Improper authorization in Samsung Health prior to version 6.30.1.003 allows local attackers to access data in Samsung Health. User interaction is required for… |
CVE-2025-21018 | Medium | 4.4 | 2025-08-06 | Out-of-bounds read in Blockchain Keystore prior to version 1.3.17.2 allows local privileged attackers to read out-of-bounds memory. |
CVE-2025-21017 | Medium | 6.3 | 2025-08-06 | Out-of-bounds write in detaching crypto box in Blockchain Keystore prior to version 1.3.17.2 allows local privileged attackers to write out-of-bounds memory. |
CVE-2025-21015 | Medium | 4.0 | 2025-08-06 | Path Traversal in Document scanner prior to SMR Aug-2025 Release 1 allows local attackers to delete file with Document scanner's privilege. |
CVE-2025-21014 | Medium | 4.3 | 2025-08-06 | Improper export of android application component in Emergency SoS prior to SMR Aug-2025 Release 1 allows local attackers to access sensitive information. |
CVE-2025-21010 | Medium | 6.0 | 2025-08-06 | Improper privilege management in SamsungAccount prior to SMR Aug-2025 Release 1 allows local privileged attackers to deactivate Samsung account. |
CVE-2025-20990 | Medium | 4.0 | 2025-08-06 | Improper access control in accessing system device node prior to SMR Aug-2025 Release 1 allows local attackers to access device identifier. |
CVE-2024-45183 | Medium | 6.5 | 2025-08-04 | An issue was discovered in Samsung Mobile Processor Exynos 2100, 1280, 2200, 1330, 1380, 1480, and 2400. A lack of a JPEG length check leads to an out-of-bound… |
CVE-2025-53082 | Medium | 6.1 | 2025-07-29 | An 'Arbitrary File Deletion' in Samsung DMS(Data Management Server) allows attackers to delete arbitrary files from unintended locations on the filesystem. Exp… |
CVE-2025-53081 | Medium | 6.4 | 2025-07-29 | An 'Arbitrary File Creation' in Samsung DMS(Data Management Server) allows attackers to create arbitrary files in unintended locations on the filesystem. Explo… |
CVE-2025-53080 | High | 7.1 | 2025-07-29 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Samsung DMS(Data Management Server) allows authenticated attackers to create… |
CVE-2025-53079 | Medium | 4.9 | 2025-07-29 | Absolute Path Traversal in Samsung DMS(Data Management Server) allows authenticated attacker (Administrator) to read sensitive files |
CVE-2025-53078 | High | 8.0 | 2025-07-29 | Deserialization of Untrusted Data in Samsung DMS(Data Management Server) allows attackers to execute arbitrary code via write file to system |
CVE-2025-53077 | Medium | 6.5 | 2025-07-29 | An execution after redirect in Samsung DMS(Data Management Server) allows attackers to execute limited functions without permissions. An attacker could comprom… |
CVE-2025-54455 | Critical | 9.1 | 2025-07-23 | Use of Hard-coded Credentials vulnerability in Samsung Electronics MagicINFO 9 Server allows Authentication Bypass.This issue affects MagicINFO 9 Server: less… |
CVE-2025-54454 | Critical | 9.1 | 2025-07-23 | Use of Hard-coded Credentials vulnerability in Samsung Electronics MagicINFO 9 Server allows Authentication Bypass.This issue affects MagicINFO 9 Server: less… |
CVE-2025-54453 | High | 8.8 | 2025-07-23 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.Th… |
CVE-2025-54452 | High | 7.3 | 2025-07-23 | Improper Authentication vulnerability in Samsung Electronics MagicINFO 9 Server allows Authentication Bypass.This issue affects MagicINFO 9 Server: less than 2… |
CVE-2025-54451 | Critical | 9.8 | 2025-07-23 | Improper Control of Generation of Code ('Code Injection') vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.This issue affects Magi… |
CVE-2025-54450 | High | 7.2 | 2025-07-23 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.Th… |
CVE-2025-54449 | Critical | 9.8 | 2025-07-23 | Unrestricted Upload of File with Dangerous Type vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.This issue affects MagicINFO 9 Se… |
CVE-2025-54448 | Critical | 9.8 | 2025-07-23 | Unrestricted Upload of File with Dangerous Type vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.This issue affects MagicINFO 9 Se… |
CVE-2025-54447 | High | 8.1 | 2025-07-23 | Unrestricted Upload of File with Dangerous Type vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.This issue affects MagicINFO 9 Se… |
CVE-2025-54446 | Critical | 9.8 | 2025-07-23 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Samsung Electronics MagicINFO 9 Server allows Upload a Web Shel… |
CVE-2025-54445 | High | 8.2 | 2025-07-23 | Improper Restriction of XML External Entity Reference vulnerability in Samsung Electronics MagicINFO 9 Server allows Server Side Request Forgery.This issue aff… |
CVE-2025-54444 | Critical | 9.8 | 2025-07-23 | Unrestricted Upload of File with Dangerous Type vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.This issue affects MagicINFO 9 Se… |
CVE-2025-54443 | Critical | 9.8 | 2025-07-23 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Samsung Electronics MagicINFO 9 Server allows Upload a Web Shel… |
CVE-2025-54442 | Critical | 9.8 | 2025-07-23 | Unrestricted Upload of File with Dangerous Type vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.This issue affects MagicINFO 9 Se… |
CVE-2025-54441 | High | 8.8 | 2025-07-23 | Unrestricted Upload of File with Dangerous Type vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.This issue affects MagicINFO 9 Se… |
CVE-2025-54440 | Critical | 9.8 | 2025-07-23 | Unrestricted Upload of File with Dangerous Type vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.This issue affects MagicINFO 9 Se… |
CVE-2025-54439 | High | 8.8 | 2025-07-23 | Unrestricted Upload of File with Dangerous Type vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.This issue affects MagicINFO 9 Se… |
CVE-2025-54438 | Critical | 9.8 | 2025-07-23 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Samsung Electronics MagicINFO 9 Server allows Upload a Web Shel… |
CVE-2025-21009 | Medium | 5.5 | 2025-07-08 | Out-of-bounds read in decoding malformed frame header in libsavsvc.so prior to Android 15 allows local attackers to cause memory corruption. |
CVE-2025-21008 | Medium | 5.5 | 2025-07-08 | Out-of-bounds read in decoding frame header in libsavsvc.so prior to Android 15 allows local attackers to cause memory corruption. |
CVE-2025-21007 | Medium | 5.5 | 2025-07-08 | Out-of-bounds write in accessing uninitialized memory in libsavsvc.so prior to Android 15 allows local attackers to cause memory corruption. |
CVE-2025-21006 | High | 7.0 | 2025-07-08 | Out-of-bounds write in handling of macro blocks for MPEG4 codec in libsavsvc.so prior to Android 15 allows local attackers to write out-of-bounds memory. |
CVE-2025-21005 | Medium | 5.5 | 2025-07-08 | Improper access control in isemtelephony prior to Android 15 allows local attackers to access sensitive information. |
CVE-2025-21004 | Medium | 6.2 | 2025-07-08 | Improper verification of intent by broadcast receiver in System UI for Galaxy Watch prior to SMR Jul-2025 Release 1 allows local attackers to power off the dev… |
CVE-2025-21003 | Medium | 4.0 | 2025-07-08 | Insecure storage of sensitive information in Emergency SOS prior to SMR Jul-2025 Release 1 allows local attackers to access sensitive information. |
CVE-2025-21002 | Medium | 6.2 | 2025-07-08 | Improper access control in LeAudioService prior to SMR Jul-2025 Release 1 allows local attackers to manipulate broadcasting Auracast. |
CVE-2025-21001 | Medium | 6.2 | 2025-07-08 | Improper access control in LeAudioService prior to SMR Jul-2025 Release 1 allows local attackers to stop broadcasting Auracast. |
CVE-2025-21000 | Medium | 6.2 | 2025-07-08 | Improper privilege management in Bluetooth prior to SMR Jul-2025 Release 1 allows local attackers to enable Bluetooth. |
CVE-2025-20999 | Medium | 4.1 | 2025-07-08 | Improper authorization in accessing saved Wi-Fi password for Galaxy Tablet prior to SMR Jul-2025 Release 1 allows secondary users to access owner's saved Wi-Fi… |
CVE-2025-20998 | Medium | 5.5 | 2025-07-08 | Improper access control in SamsungAccount for Galaxy Watch prior to SMR Jul-2025 Release 1 allows local attackers to access phone number. |
CVE-2025-20997 | Medium | 6.2 | 2025-07-08 | Incorrect default permission in Framework for Galaxy Watch prior to SMR Jul-2025 Release 1 allows local attackers to reset some configuration of Galaxy Watch. |
CVE-2025-20983 | Medium | 6.4 | 2025-07-08 | Out-of-bounds write in checking auth secret in KnoxVault trustlet prior to SMR Jul-2025 Release 1 allows local privileged attackers to write out-of-bounds memo… |
CVE-2025-20982 | Medium | 6.4 | 2025-07-08 | Out-of-bounds write in setting auth secret in KnoxVault trustlet prior to SMR Jul-2025 Release 1 allows local privileged attackers to write out-of-bounds memor… |
CVE-2025-47202 | Critical | 9.1 | 2025-07-07 | In RRC in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 9110, W920, W930… |
CVE-2025-26780 | High | 7.5 | 2025-07-07 | An issue was discovered in L2 in Samsung Mobile Processor and Modem Exynos 2400 and Modem 5400. The lack of a length check leads to a Denial of Service via a m… |
CVE-2025-53076 | Critical | 9.8 | 2025-06-30 | Improper Input Validation vulnerability in Samsung Open Source rLottie allows Overread Buffers.This issue affects rLottie: V0.2. |
CVE-2025-53074 | Critical | 9.1 | 2025-06-30 | Out-of-bounds Read vulnerability in Samsung Open Source rLottie allows Overflow Buffers.This issue affects rLottie: V0.2. |
CVE-2025-53075 | Critical | 9.8 | 2025-06-30 | Improper Input Validation vulnerability in Samsung Open Source rLottie allows Path Traversal.This issue affects rLottie: V0.2. |
CVE-2025-0634 | Critical | 9.8 | 2025-06-30 | Use After Free vulnerability in Samsung Open Source rLottie allows Remote Code Inclusion.This issue affects rLottie: V0.2. |
CVE-2025-23106 | Medium | 6.5 | 2025-06-04 | An issue was discovered in Samsung Mobile Processor Exynos 2200, 1480, and 2400. A Use-After-Free in the mobile processor leads to privilege escalation. |
CVE-2025-23101 | Medium | 6.5 | 2025-06-04 | An issue was discovered in Samsung Mobile Processor Exynos 1380. A Use-After-Free in the mobile processor leads to privilege escalation. |