Samsung
Page 5 of 17 — Samsung CVEs from a corpus of 1634, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-20910 | Medium | 6.2 | 2025-03-06 | Incorrect default permission in Galaxy Watch Gallery prior to SMR Mar-2025 Release 1 allows local attackers to access data in Galaxy Watch Gallery. |
CVE-2025-20909 | Medium | 4.0 | 2025-03-06 | Use of implicit intent for sensitive communication in Settings prior to SMR Mar-2025 Release 1 allows local attackers to access sensitive information. |
CVE-2025-20908 | Medium | 6.5 | 2025-03-06 | Use of insufficiently random values in Auracast prior to SMR Mar-2025 Release 1 allows adjacent attackers to access Auracast broadcasting. |
CVE-2025-20903 | High | 7.3 | 2025-03-06 | Improper access control in SecSettingsIntelligence prior to SMR Mar-2025 Release 1 allows local attackers to launch privileged activities. User interaction is… |
CVE-2024-46923 | High | 7.5 | 2025-02-12 | An issue was discovered in Samsung Mobile Processor Exynos 2200, 1480, and 2400. The absence of a null check leads to a Denial of Service at amdgpu_cs_ib_fill… |
CVE-2024-46922 | High | 7.5 | 2025-02-12 | An issue was discovered in Samsung Mobile Processor Exynos 1480 and 2400. The absence of a null check leads to a Denial of Service at amdgpu_cs_parser_bos in t… |
CVE-2025-20907 | Medium | 6.0 | 2025-02-04 | Improper privilege management in Samsung Find prior to SMR Feb-2025 Release 1 allows local privileged attackers to disable Samsung Find. |
CVE-2025-20905 | Medium | 6.3 | 2025-02-04 | Out-of-bounds read and write in mPOS TUI trustlet prior to SMR Feb-2025 Release 1 allows local privileged attackers to read and write out-of-bounds memory. |
CVE-2025-20904 | Medium | 6.3 | 2025-02-04 | Out-of-bounds write in mPOS TUI trustlet prior to SMR Feb-2025 Release 1 allows local privileged attackers to cause memory corruption. |
CVE-2025-20901 | Medium | 4.4 | 2025-02-04 | Out-of-bounds read in Blockchain Keystore prior to version 1.3.16.5 allows local privileged attackers to read out-of-bounds memory. |
CVE-2025-20900 | Medium | 6.3 | 2025-02-04 | Out-of-bounds write in Blockchain Keystore prior to version 1.3.16.5 allows local privileged attackers to write out-of-bounds memory. |
CVE-2025-20898 | Medium | 4.6 | 2025-02-04 | Improper input validation in Samsung Members prior to version 5.2.00.12 allows physical attackers to access data across multiple user profiles. |
CVE-2025-20896 | Medium | 4.0 | 2025-02-04 | Use of implicit intent for sensitive communication in EasySetup prior to version 11.1.18 allows local attackers to access sensitive information. |
CVE-2025-20895 | Low | 3.2 | 2025-02-04 | Authentication Bypass Using an Alternate Path in Galaxy Store prior to version 4.5.87.6 allows physical attackers to install arbitrary applications to bypass r… |
CVE-2025-20894 | Medium | 4.6 | 2025-02-04 | Improper access control in Samsung Email prior to version 6.1.97.1 allows physical attackers to access data across multiple user profiles. |
CVE-2025-20893 | Medium | 5.1 | 2025-02-04 | Improper access control in NotificationManager prior to SMR Jan-2025 Release 1 allows local attackers to change the configuration of notifications. |
CVE-2025-20892 | Medium | 5.9 | 2025-02-04 | Protection Mechanism Failure in bootloader prior to SMR Jan-2025 Release 1 allows physical attackers to allow to execute fastboot command. User interaction is… |
CVE-2025-20891 | Medium | 5.3 | 2025-02-04 | Out-of-bounds read in decoding malformed bitstream of video thumbnails in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attackers to read arbitrary… |
CVE-2025-20890 | High | 7.0 | 2025-02-04 | Out-of-bounds write in decoding frame buffer in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attackers to execute arbitrary code with privilege. U… |
CVE-2025-20889 | Medium | 5.3 | 2025-02-04 | Out-of-bounds read in decoding malformed bitstream for smp4vtd in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attackers to read arbitrary memory… |
CVE-2025-20888 | High | 7.0 | 2025-02-04 | Out-of-bounds write in handling the block size for smp4vtd in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attackers to execute arbitrary code wit… |
CVE-2025-20887 | Medium | 5.3 | 2025-02-04 | Out-of-bounds read in accessing table used for svp8t in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attackers to read arbitrary memory. User inte… |
CVE-2025-20886 | Medium | 4.1 | 2025-02-04 | Inclusion of sensitive information in test code in softsim trustlet prior to SMR Jan-2025 Release 1 allows local privileged attackers to get test key. |
CVE-2025-20885 | Medium | 6.4 | 2025-02-04 | Out-of-bounds write in softsim trustlet prior to SMR Jan-2025 Release 1 allows local privileged attackers to cause memory corruption. |
CVE-2025-20884 | Medium | 4.6 | 2025-02-04 | Improper access control in Samsung Message prior to SMR Jan-2025 Release 1 allows physical attackers to access data across multiple user profiles. |
CVE-2025-20883 | Medium | 4.6 | 2025-02-04 | Improper access control in SoundPicker prior to SMR Jan-2025 Release 1 allows physical attackers to access data across multiple user profiles. |
CVE-2025-20882 | High | 7.0 | 2025-02-04 | Out-of-bounds write in accessing uninitialized memory for svc1td in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attackers to execute arbitrary co… |
CVE-2025-20881 | High | 7.0 | 2025-02-04 | Out-of-bounds write in accessing buffer storing the decoded video frames in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attackers to execute arbi… |
CVE-2024-46921 | Medium | 6.5 | 2025-01-13 | An issue was discovered in Samsung Mobile Processor and Modem Exynos 9820, 9825, 980, 990, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 9110, W1000, Modem 5… |
CVE-2024-46920 | Medium | 6.5 | 2025-01-13 | An issue was discovered in Samsung Mobile Processor Exynos 9820, 9825, 980, 990, 850, 1080, 2100, and 1280. Lack of a length check leads to a stack out-of-boun… |
CVE-2024-48883 | Medium | 4.3 | 2025-01-13 | An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 9820, 9825, 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480… |
CVE-2024-46919 | Medium | 5.3 | 2025-01-13 | An issue was discovered in Samsung Mobile Processor Exynos 9820, 9825, 980, 990, 850, 1080, 2100, and 1280. Lack of a length check leads to a stack out-of-boun… |
CVE-2024-49422 | Medium | 5.2 | 2024-12-31 | Protection Mechanism Failure in bootloader prior to SMR Oct-2024 Release 1 allows physical attackers to reset lockscreen failure count by hardware fault inject… |
CVE-2024-53921 | Low | 2.8 | 2024-12-03 | An issue was discovered in the installer in Samsung Magician 8.1.0 on Windows. An attacker can create arbitrary folders in the system permission directory via… |
CVE-2024-49421 | Medium | 4.3 | 2024-12-03 | Path traversal in Quick Share Agent prior to version 3.5.14.47 in Android 12, 3.5.19.41 in Android 13, and 3.5.19.42 in Android 14 allows adjacent attackers to… |
CVE-2024-49417 | Low | 2.0 | 2024-12-03 | Use of implicit intent for sensitive communication in Smart Touch Call prior to 1.0.0.8 allows local attackers to launch privileged activities. User interactio… |
CVE-2024-49416 | Medium | 4.0 | 2024-12-03 | Use of implicit intent for sensitive communication in SmartThings prior to version 1.8.21 allows local attackers to get sensitive information. |
CVE-2024-49415 | High | 8.1 | 2024-12-03 | Out-of-bound write in libsaped.so prior to SMR Dec-2024 Release 1 allows remote attackers to execute arbitrary code. |
CVE-2024-49414 | Low | 2.4 | 2024-12-03 | Authentication Bypass Using an Alternate Path in Dex Mode prior to SMR Dec-2024 Release 1 allows physical attackers to temporarily access to recent app list. |
CVE-2024-49413 | High | 7.1 | 2024-12-03 | Improper Verification of Cryptographic Signature in SmartSwitch prior to SMR Dec-2024 Release 1 allows local attackers to install malicious applications. |
CVE-2024-49411 | Medium | 4.3 | 2024-12-03 | Path Traversal in ThemeCenter prior to SMR Dec-2024 Release 1 allows physical attackers to copy apk files to arbitrary path with ThemeCenter privilege. |
CVE-2024-49410 | Medium | 5.9 | 2024-12-03 | Out-of-bounds write in libswmfextractor.so prior to SMR Dec-2024 Release 1 allows local attackers to execute arbitrary code. |
CVE-2024-39890 | High | 8.1 | 2024-12-02 | An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 9820, 9825, 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480… |
CVE-2024-39343 | High | 7.0 | 2024-12-02 | An issue was discovered in Samsung Mobile Processor and Wearable Processor Exynos 2100, 1280, 2200, 1330, 1380, 1480, 2400, 9110, Modem 5123, and Modem 5300. T… |
CVE-2024-49409 | Medium | 6.4 | 2024-11-06 | Out-of-bounds write in Battery Full Capacity node prior to Firmware update Sep-2024 Release on Galaxy S24 allows local attackers to write out-of-bounds memory… |
CVE-2024-49408 | Medium | 6.4 | 2024-11-06 | Out-of-bounds write in usb driver prior to Firmware update Sep-2024 Release on Galaxy S24 allows local attackers to write out-of-bounds memory. System privileg… |
CVE-2024-49407 | Medium | 4.6 | 2024-11-06 | Improper access control in Samsung Flow prior to version 4.9.15.7 allows physical attackers to access data across multiple user profiles. |
CVE-2024-49406 | Medium | 6.7 | 2024-11-06 | Improper validation of integrity check value in Blockchain Keystore prior to version 1.3.16 allows local attackers to modify transaction. Root privilege is req… |
CVE-2024-49405 | Medium | 5.3 | 2024-11-06 | Improper authentication in Private Info in Samsung Pass in prior to version 4.4.04.7 allows physical attackers to access sensitive information in a specific sc… |
CVE-2024-49404 | Medium | 5.5 | 2024-11-06 | Improper Access Control in Samsung Video Player prior to versions 7.3.29.1 in Android 12, 7.3.36.1 in Android 13, and 7.3.41.230 in Android 14 allows physical… |
CVE-2024-49403 | Medium | 4.6 | 2024-11-06 | Improper access control in Samsung Voice Recorder prior to version 21.5.40.37 allows physical attackers to access recording files on the lock screen. |
CVE-2024-49402 | Medium | 4.6 | 2024-11-06 | Improper input validation in Dressroom prior to SMR Nov-2024 Release 1 allow physical attackers to access data across multiple user profiles. |
CVE-2024-49401 | Medium | 5.1 | 2024-11-06 | Improper input validation in Settings Suggestions prior to SMR Nov-2024 Release 1 allows local attackers to launch privileged activities. |
CVE-2024-34682 | Low | 2.4 | 2024-11-06 | Improper authorization in Settings prior to SMR Nov-2024 Release 1 allows physical attackers to access stored WiFi password in Maintenance Mode. |
CVE-2024-34680 | Medium | 4.0 | 2024-11-06 | Use of implicit intent for sensitive communication in WlanTest prior to SMR Nov-2024 Release 1 allows local attackers to get sensitive information. |
CVE-2024-34679 | Medium | 4.0 | 2024-11-06 | Incorrect default permissions in Crane prior to SMR Nov-2024 Release 1 allows local attackers to access files with phone privilege. |
CVE-2024-34678 | Medium | 5.9 | 2024-11-06 | Out-of-bounds write in libsapeextractor.so prior to SMR Nov-2024 Release 1 allows local attackers to cause memory corruption. |
CVE-2024-34677 | Medium | 4.0 | 2024-11-06 | Exposure of sensitive information in System UI prior to SMR Nov-2024 Release 1 allow local attackers to make malicious apps appear as legitimate. |
CVE-2024-34676 | Medium | 4.4 | 2024-11-06 | Out-of-bounds write in parsing subtitle file in libsubextractor.so prior to SMR Nov-2024 Release 1 allows local attackers to cause memory corruption. User inte… |
CVE-2024-34675 | Low | 2.4 | 2024-11-06 | Improper access control in Dex Mode prior to SMR Nov-2024 Release 1 allows physical attackers to temporarily access to unlocked screen. |
CVE-2024-34674 | Medium | 4.6 | 2024-11-06 | Improper access control in Contacts prior to SMR Nov-2024 Release 1 allows physical attackers to access data across multiple user profiles. |
CVE-2024-34673 | Medium | 4.1 | 2024-11-06 | Improper Input Validation in IpcProtocol in Modem prior to SMR Nov-2024 Release 1 allows local attackers to cause Denial-of-Service. |
CVE-2024-45185 | Medium | 5.1 | 2024-11-04 | An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 9820, 9825, 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480… |
CVE-2024-45184 | Medium | 6.2 | 2024-10-11 | An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modems with chipset Exynos 9820, 9825, 980, 990, 850, 1080, 2100, 1280, 2200, 1330… |
CVE-2024-34672 | Medium | 5.5 | 2024-10-08 | Improper input validation in SamsungVideoPlayer prior to versions 7.3.29.1 in Android 12, 7.3.36.1 in Android 13, and 7.3.41.230 in Android 14 allows local att… |
CVE-2024-34671 | Low | 3.3 | 2024-10-08 | Use of implicit intent for sensitive communication in translation혻in Samsung Internet prior to version 26.0.3.1 allows local attackers to get sensitive informa… |
CVE-2024-34670 | Medium | 4.0 | 2024-10-08 | Use of implicit intent for sensitive communication in Sound Assistant prior to version 6.1.0.9 allows local attackers to get sensitive information. |
CVE-2024-34669 | High | 7.5 | 2024-10-08 | Out-of-bounds write in parsing h.263+ format in librtppayload.so prior to SMR Oct-2024 Release 1 allows remote attackers to execute arbitrary code with system… |
CVE-2024-34668 | High | 7.5 | 2024-10-08 | Out-of-bounds write in parsing h.263 format in librtppayload.so prior to SMR Oct-2024 Release 1 allows remote attackers to execute arbitrary code with system p… |
CVE-2024-34667 | High | 7.5 | 2024-10-08 | Out-of-bounds write in parsing h.265 format in librtppayload.so prior to SMR Oct-2024 Release 1 allows remote attackers to execute arbitrary code with system p… |
CVE-2024-34666 | High | 7.5 | 2024-10-08 | Out-of-bounds write in parsing h.264 format in a specific mode in librtppayload.so prior to SMR Oct-2024 Release 1 allows remote attackers to execute arbitrary… |
CVE-2024-34665 | High | 7.5 | 2024-10-08 | Out-of-bounds write in parsing h.264 format in librtppayload.so prior to SMR Oct-2024 Release 1 allows remote attackers to execute arbitrary code with system p… |
CVE-2024-34662 | Medium | 6.2 | 2024-10-08 | Improper access control in ActivityManager prior to SMR Oct-2024 Release 1 in select Android 12, 13 and SMR Sep-2024 Release 1 in select Android 14 allows loca… |
CVE-2024-44068 | High | 8.1 | 2024-10-07 | An issue was discovered in the m2m scaler driver in Samsung Mobile Processor and Wearable Processor Exynos 9820, 9825, 980, 990, 850,and W920. A Use-After-Free… |
CVE-2024-5760 | High | 7.8 | 2024-09-11 | The Samsung Universal Print Driver for Windows is potentially vulnerable to escalation of privilege allowing the creation of a reverse shell in the tool. This… |
CVE-2024-31960 | High | 7.8 | 2024-09-10 | An issue was discovered in Samsung Mobile Processor Exynos 1480, Exynos 2400. The xclipse amdgpu driver has a reference count bug. This can lead to a use after… |
CVE-2024-25074 | Medium | 5.9 | 2024-09-10 | An issue was discovered in Samsung Semiconductor Mobile Processor and Modem Exynos 9820, Exynos 9825, Exynos 980, Exynos 990, Exynos 850, Exynos 1080, Exynos 2… |
CVE-2024-25073 | Medium | 5.9 | 2024-09-10 | An issue was discovered in Samsung Semiconductor Mobile Processor and Modem Exynos 9820, Exynos 9825, Exynos 980, Exynos 990, Exynos 850, Exynos 1080, Exynos 2… |
CVE-2024-27365 | Medium | 4.4 | 2024-09-09 | An issue was discovered in Samsung Mobile Processor Exynos Exynos 980, Exynos 850, Exynos 1080, Exynos 1280, Exynos 1380, Exynos 1330, Exynos 1480, Exynos W920… |
CVE-2024-27387 | Medium | 6.7 | 2024-09-09 | An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. In the function slsi_rx_range_done_ind()… |
CVE-2024-27383 | Medium | 6.7 | 2024-09-09 | An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. In the function slsi_get_scan_extra_ies(… |
CVE-2024-27368 | Medium | 4.4 | 2024-09-09 | An issue was discovered in Samsung Mobile Processor Exynos Mobile Processor, Wearable Processor Exynos 980, Exynos 850, Exynos 1080, Exynos 1280, Exynos 1380… |
CVE-2024-27367 | Medium | 4.4 | 2024-09-09 | An issue was discovered in Samsung Mobile Processor Exynos Wearable Processor Exynos 980, Exynos 850, Exynos 1080, Exynos 1280, Exynos 1380, Exynos 1330, Exyno… |
CVE-2024-27366 | Medium | 4.4 | 2024-09-09 | An issue was discovered in Samsung Mobile Processor, Wearable Processor Exynos Exynos 980, Exynos 850, Exynos 1080, Exynos 1280, Exynos 1380, Exynos 1330, Exyn… |
CVE-2024-27364 | Medium | 4.4 | 2024-09-09 | An issue was discovered in Mobile Processor, Wearable Processor Exynos 980, Exynos 850, Exynos 1080, Exynos 1280, Exynos 1380, Exynos 1330, Exynos 1480, Exynos… |
CVE-2024-34661 | Medium | 4.3 | 2024-09-04 | Improper handling of insufficient permissions in Samsung Assistant prior to version 9.1.00.7 allows remote attackers to access location data. User interaction… |
CVE-2024-34660 | High | 7.3 | 2024-09-04 | Heap-based out-of-bounds write in Samsung Notes prior to version 4.4.21.62 allows local attackers to execute arbitrary code. |
CVE-2024-34659 | High | 7.5 | 2024-09-04 | Exposure of sensitive information in GroupSharing prior to version 13.6.13.3 allows remote attackers can force the victim to join the group. |
CVE-2024-34658 | Medium | 4.0 | 2024-09-04 | Out-of-bounds read in Samsung Notes allows local attackers to bypass ASLR. |
CVE-2024-34657 | High | 8.6 | 2024-09-04 | Stack-based out-of-bounds write in Samsung Notes prior to version 4.4.21.62 allows remote attackers to execute arbitrary code. |
CVE-2024-34656 | High | 7.3 | 2024-09-04 | Path traversal in Samsung Notes prior to version 4.4.21.62 allows local attackers to execute arbitrary code. |
CVE-2024-34655 | Medium | 6.2 | 2024-09-04 | Incorrect use of privileged API in UniversalCredentialManager prior to SMR Sep-2024 Release 1 allows local attackers to access privileged API related to Univer… |
CVE-2024-34654 | Medium | 6.2 | 2024-09-04 | Improper Export of android application component in My Files prior to SMR Sep-2024 Release 1 allows local attackers to access files with My Files' privilege. |
CVE-2024-34653 | Medium | 4.6 | 2024-09-04 | Path Traversal in My Files prior to SMR Sep-2024 Release 1 allows physical attackers to access directories with My Files' privilege. |
CVE-2024-34652 | Medium | 4.0 | 2024-09-04 | Incorrect authorization in kperfmon prior to SMR Sep-2024 Release 1 allows local attackers to access information related to performance including app usage. |
CVE-2024-34651 | Medium | 6.2 | 2024-09-04 | Improper authorization in My Files prior to SMR Sep-2024 Release 1 allows local attackers to access restricted data in My Files. |
CVE-2024-34650 | Medium | 4.0 | 2024-09-04 | Incorrect authorization in CocktailbarService prior to SMR Sep-2024 Release 1 allows local attackers to access privileged APIs related to Edge panel. |
CVE-2024-34649 | Low | 2.4 | 2024-09-04 | Improper access control in new Dex Mode in multitasking framework prior to SMR Sep-2024 Release 1 allows physical attackers to temporarily access an unlocked s… |
CVE-2024-34648 | Medium | 5.1 | 2024-09-04 | Improper Handling of Insufficient Permissions in KnoxMiscPolicy prior to SMR Sep-2024 Release 1 allows local attackers to access sensitive data. |
CVE-2024-34647 | Medium | 4.0 | 2024-09-04 | Incorrect use of privileged API in DualDarManagerProxy prior to SMR Sep-2024 Release 1 allows local attackers to access privileged APIs related to knox without… |