CVE-2024-20805

The CVE-2024-20805 entry documents a path traversal vulnerability in the ZipCompressor of MyFiles. Affected: Samsung Android devices running MyFiles on Android 11/12 (prior to SMR Jan-2024 Release 1) and Android 13 (MyFiles 14.5.00.21). Impact: local attackers can write arbitrary files. Root caus...

CVE-2024-20830

Summary: Samsung Mobile AppLock had an incorrect default permission in versions prior to SMR Mar-2024 Release 1, enabling local attackers to configure AppLock settings. Impact (from available data): Local, low-complexity access with low confidentiality/integrity/availability impact (CVSS v3.1 bas...

CVE-2024-20834

CVE-2024-20834 affects the WlanTest module in Samsung mobile environments. Affected: WlanTest versions prior to SMR Mar-2024 Release 1. Issue: sensitive information exposure enables local attackers to access the MAC address without permission. Impact: local disclosure of a low-integrity, low-avai...

CVE-2024-20847

The vulnerability CVE-2024-20847 affects StorageManagerService prior to SMR Apr-2024 Release 1. Root cause: Improper Access Control that allows local attackers to read SD card information. Affects Samsung Mobile devices' StorageManagerService implementation; remediation is to update to SMR Apr-20...

CVE-2024-20836

CVE-2024-20836 describes an out-of-bounds read in libsubextractor.so (ssmis_get_frm) prior to SMR Mar-2024 Release 1, enabling local attackers to read memory. Affected: libsubextractor.so; Impact: read access to out-of-bounds memory. Mitigation: upgrade to SMR Mar-2024 Release 1 or later; tempora...

CVE-2024-20848

CVE-2024-20848 affects libsdffextractor’s text parsing. Affected versions are prior to SMR Apr-2024 Release 1, with an Improper Input Validation root cause that allows a local attacker to write out-of-bounds memory. The issue is documented in PT-2024-18757 and corroborated by multiple sources not...

CVE-2024-20896

CVE-2024-20896 describes a vulnerability in Samsung Mobile devices prior to the SMR Jul-2024 Release 1 where the configuration message uses implicit intents for sensitive communication. The root cause is the handling of implicit intents that can leak sensitive information to local attackers. The ...

CVE-2024-20900

CVE-2024-20900 affects Samsung Mobile devices via the MTP application. The issue is improper authentication that allows local attackers to enter MTP mode without proper authentication. Public documentation states affected firmware is prior to SMR Jul-2024 Release 1 and recommends updating to SMR ...

CVE-2025-20905

CVE-2025-20905 concerns the mPOS TUI trustlet. The issue is an out-of-bounds read and write in versions prior to Samsung SMR Feb-2025 Release 1, enabling local privileged attackers to read and write memory out-of-bounds. Impact is described as high for confidentiality, integrity, and availability...

CVE-2023-21424

The CVE-2023-21424 issue affects SemChameleonHelper prior to SMR Jan-2023 Release 1, due to improper handling of insufficient permissions/privileges. An attacker could modify network-related values, network code, carrier ID and operator brand. Impact is limited to local context with low base metr...

CVE-2023-30700

The CVE-2023-30700 issue affects the Android/Samsung framework component SemWifiApTimeOutImpl, where a PendingIntent hijacking vulnerability could allow local attackers to access a ContentProvider without proper permission. Concrete details found in connected sources indicate affected framework v...

CVE-2024-20888

CVE-2024-20888 : Improper access control in Samsung OneUIHome prior to SMR Jul-2024 Release 1 enables local attackers to launch privileged activities. Impact: high confidentiality, integrity, and availability concerns; attack vector is local with user interaction required. Affected software: OneU...

CVE-2025-20888

CVE-2025-20888 involves an out-of-bounds write in handling the block size for smp4vtd in libsthmbc.so, prior to Samsung SMR Jan-2025 Release 1. Affected component: libsthmbc.so on Samsung Mobile devices. Root cause: out-of-bounds write when processing block sizes for smp4vtd. Impact: local arbitr...

CVE-2025-20961

The connected PT-2025-20046 entry provides concrete details for CVE-2025-20961: the vulnerability affects the sepunion service, with improper handling of insufficient privileges allowing local privileged attackers to access files with system privileges. Affected versions are prior to SMR May-2025...

CVE-2023-42536

The CVE-2023-42536 issue affects libsaped’s saped_dec component in Samsung Libsaped, with versions prior to the SMR Nov-2023 Release 1 being vulnerable. The root cause is improper input validation in saped_dec, enabling local attackers to trigger an out-of-bounds read and write, potentially compr...

CVE-2024-20862

CVE-2024-20862 affects SveService on Samsung Mobile devices prior to SMR May-2024 Release 1. The vulnerability is an out-of-bounds write that enables local privileged attackers to execute arbitrary code. Exploitation details are not provided in the sources, and no in-the-wild exploit information ...

CVE-2024-20893

CVE-2024-20893 describes improper input validation in libmediaextractorservice.so prior to the Samsung SMR Jul-2024 Release 1, enabling local attackers to trigger memory corruption. Public sources consistently reference Samsung Mobile devices as affected; documentation from Red Hat and NVD corrob...

CVE-2025-20883

CVE-2025-20883 concerns an improper access control flaw in the Samsung SoundPicker component prior to SMR Jan‑2025 Release 1. The root cause is improper access control that allows a physical attacker to access data across multiple user profiles on a device. Reported impact is exposure of data fro...

CVE-2025-20934

CVE-2025-20934 describes an improper access control vulnerability in Samsung’s Sticker Center prior to the SMR Apr-2025 Release 1. The issue allows local attackers with low privileges to access image files with system-level privileges, implying a local privilege escalation risk. Affected software...

CVE-2023-21437

CVE-2023-21437 affects the Samsung Phone application prior to SMR Feb-2023 Release 1. The root cause is improper access control, enabling local attackers to access sensitive information via implicit broadcast. Impact is described as exposure of sensitive data with local attacker access and no use...

CVE-2023-30693

CVE-2023-30693 concerns an out-of-bounds write in libsec-ril’s DoOemFactorySendFactoryBypassCommand. Multiple connected sources consistently describe this as a local privilege escalation/remote code execution vector, where a local attacker can execute arbitrary code due to a bounds check issue in...

CVE-2023-30688

The CVE-2023-30688 entry covers an out-of-bounds write in MakeUiccAuthForOem of libsec-ril, reported for Samsung Mobile devices in the SMR Aug-2023 Release 1. The issue enables a local attacker to execute arbitrary code. Public references in the provided documents identify the affected component ...

CVE-2024-20811

CVE-2024-20811 concerns Samsung Mobile’s GameOptimizer . The root cause is improper caller verification , enabling a local attacker to configure GameOptimizer. Affected are Samsung devices with the GameOptimizer component prior to the SMR Feb-2024 Release 1. The entry notes local access from an u...

CVE-2024-20859

CVE-2024-20859 concerns Samsung FactoryCamera on Samsung Mobile devices prior to SMR May-2024 Release 1. The root cause is improper access control, enabling local attackers to take pictures without privileges. Impact is local access to camera output with elevated risk to sensitive information. Re...

CVE-2025-20891

CVE-2025-20891 : Out-of-bounds read in decoding malformed bitstreams of video thumbnails in libsthmbc.so, enabling local attackers to read memory. Affected on Samsung Mobile devices prior to SMR Jan-2025 Release 1; exploitation requires user interaction. Multiple sources confirm the issue and ref...

CVE-2023-21436

CVE-2023-21436 affects Samsung Contacts prior to SMR Feb-2023 Release 1, due to improper usage of implicit intents that allows a local attacker to obtain an account ID. Connected sources indicate the issue impacts Samsung Mobile devices and that updates addressing it were included in SMR Feb-2023...

CVE-2023-30679

CVE-2023-30679 : Samsung Mobile devices with the HDCP trustlet prior to SMR Aug-2023 Release 1 are affected. The issue is improper access control that could allow a local attacker to execute arbitrary code. Reported remediation is to update to SMR Aug-2023 Release 1 or later; temporary mitigation...

CVE-2023-30685

CVE-2023-30685 is an improper access control vulnerability in Samsung Telecom software prior to SMR Aug-2023 Release 1 that allows a local attacker to change the TTY mode. The issue is described across multiple sources (e.g., PT-2023-22883, Red Hat advisory, NVD) as affecting Telecom components b...

CVE-2023-52432

The CVE involves Samsung libsec-ril, specifically the IpcTxSndSetLoopbackCtrl function. Affected: libsec-ril versions prior to SMR Sep-2023 Release 1. Root cause: improper input validation in IpcTxSndSetLoopbackCtrl. Impact: local attackers can write out-of-bounds memory, with potential confident...

CVE-2025-20904

CVE-2025-20904 involves an out-of-bounds write in the mPOS TUI trustlet on Samsung Mobile devices, prior to SMR Feb-2025 Release 1, enabling local privileged attackers to cause memory corruption. Affected component: mPOS TUI trustlet; root cause: out-of-bounds write leading to memory corruption; ...

CVE-2026-21069

A type-conversion bug in the VC1 codec of libsavsvc.so allows local attackers to write out-of-bounds memory. Exploitation requires local access with low privileges. No in-the-wild exploitation is reported. Fix: update to Samsung SMR Aug-2026 Release 1.

CVE-2023-30690

CVE-2023-30690 relates to an improper input validation vulnerability in Samsung Duo prior to SMR Oct-2023 Release 1. The issue enables local attackers to perform privileged activities by exploiting input validation flaws in the Duo component on affected Samsung mobile devices. Affected software i...

CVE-2023-30721

CVE-2023-30721 affects Samsung Android devices via a vulnerability in the Locksettings logging path where sensitive information can be inserted into logs. The underlying issue is the insertion of lockscreen match information into log data, allowing a local attacker with privileged access to read ...

CVE-2024-20895

CVE-2024-20895 affects Samsung Mobile devices’ Dar service, where improper access control allows a local attacker to bypass restrictions on calling SDP features. The issue is tied to Dar service prior to SMR Jul-2024 Release 1 and has been addressed by updating to SMR Jul-2024 Release 1 or later....

CVE-2026-21067

Improper input validation in libsmsd.so (Samsung Mobile), present before the August 2026 Security Maintenance Release, allows local attackers to write out-of-bounds memory, potentially achieving full system compromise. No public exploitation details are provided. Upgrade to SMR Aug-2026 Release 1...

CVE-2026-21068

A stack-based buffer overflow exists in libril_sem.so prior to Samsung SMR Aug-2026 Release 1, enabling a privileged local attacker to execute arbitrary code. The vulnerability is tied to the libril_sem.so component; no further technical details (such as affected versions beyond the release windo...

CVE-2023-30711

Technical details (affected products, versions, exploit information, and fixes) are not publicly provided in the supplied documents. Monitor for updates from Samsung and vendors for a confirmed fix and impact.

CVE-2024-20866

Setupwizard on Samsung mobile devices contains an authentication bypass vulnerability prior to SMR May-2024 Release 1, allowing a physical attacker to bypass the activation step. According to PT-2024-18776, the issue affects Setupwizard versions prior to the May-2024 Release 1 and can be mitigate...

CVE-2024-49422

CVE-2024-49422 describes a protection mechanism failure in the bootloader of Samsung mobile devices. Prior to SMR Oct-2024 Release 1, the bootloader protection can be bypassed by a hardware fault injection, allowing a physical attacker to reset the lockscreen failure count. The exploit requires u...

CVE-2023-21430

Consolidated details show CVE-2023-21430 affects libSDKRecognitionText.spensdk.samsung.so (Samsung) for software prior to SMR JAN-2023 Release 1. Root cause is an out-of-bounds read in the mapToBuffer function that can cause a memory access fault. Impact descriptions in sources indicate memory ac...

CVE-2023-21441

The CVE-2023-21441 entry concerns a Guarded Routine component in Android on Samsung devices with insufficient verification of data authenticity. Affected versions are Android Q before 2.6.30.6, Android R before 3.1.21.10, and Android S before 3.5.2.23, where a local attacker could access protecte...

CVE-2023-21451

CVE-2023-21451 : A stack-based overflow affects the IpcRxEmbmsSessionList component in SECRIL on Samsung Android devices prior to Android S(12), leading to memory corruption. The vulnerability is local in nature with attacker-controlled memory corruption potential as described in multiple sources...

CVE-2023-21504

CVE-2023-21504 affects Shannon baseband, specifically the mm_Plmncoordination.c module. A potential buffer overflow exists in Shannon baseband prior to SMR May-2023 Release 1, allowing remote attackers to cause invalid memory access. Root cause: issues in the mm_Plmncoordination.c implementation ...

CVE-2024-20856

CVE-2024-20856 relates to an improper authentication vulnerability in Samsung Mobile Secure Folder. In a specific scenario, physical attackers could access Secure Folder without proper authentication. The issue affects Secure Folder versions prior to SMR May-2024 Release 1. Mitigation: update to ...

CVE-2025-20941

InputManager on Samsung SMR Apr-2025 Release 1 is affected by improper access control, allowing a local attacker to access the scancode of a specific input device. The issue is described in PT-2025-15342 and is supported by CVE-2025-20941 records across multiple feeds. There are no exploit detail...

CVE-2025-20960

CVE-2025-20960 affects CocktailBarService (Samsung) and is caused by improper handling of insufficient permissions in the service, enabling a local attacker to invoke the privileged API before the SMR May-2025 Release 1 patch. Connected sources confirm the issue applies to CocktailBarService vers...

CVE-2023-21438

CVE-2023-21438 : Samsung Mobile devices with affected HomeScreen prior to SMR Feb-2023 Release 1 expose a logic flaw that lets a physical attacker access an App preview guarded by Secure Folder. The issue is described as improper logic in HomeScreen, enabling access to protected previews. Public ...

CVE-2023-30681

CVE-2023-30681 affects HAL VaultKeeper, specifically the initialize function. Connected sources confirm the vulnerability is an improper input validation that can lead to an out-of-bounds write in VaultKeeper prior to SMR Aug-2023 Release 1. Impact per NVD indicates HIGH severity (CVSSv3.1: AV:L/...

CVE-2024-20855

The vulnerability CVE-2024-20855 affects the multitasking framework (Samsung Mobile devices) with improper access control. Versions prior to SMR May-2024 Release 1 allow physical attackers to access an unlocked screen for a period of time. Remediation: update to SMR May-2024 Release 1 or later. N...

CVE-2024-20861

CVE-2024-20861 is a use-after-free vulnerability in SveService on Samsung Mobile devices before SMR May-2024 Release 1, enabling local privileged attackers to cause memory corruption. Affected component: SveService; root cause: use-after-free. Impact per sources: local privilege escalation with p...