CVE-2023-21449

The CVE-2023-21449 entry concerns the Samsung Call application with improper access control, enabling local attackers to access sensitive information without permission. Affected component is the Call application (prior to SMR Mar-2023 Release 1); root cause is improper access control. Public det...

CVE-2023-30654

CVE-2023-30654 concerns Samsung Mobile devices and targets the SLocationService race for location data. The vulnerability is an improper access control in SLocationService prior to the SMR Aug-2023 Release 1, which allows a local attacker to update a fake location. The documented impact indicates...

CVE-2023-30713

The CVE-2023-30713 entry describes an improper privilege management vulnerability in Samsung One UI Home’s FolderLockNotifier. Affected component: FolderLockNotifier (One UI Home) prior to SMR Sep-2023 Release 1. Root cause: insufficient privilege controls allow local attackers to modify some fol...

CVE-2024-20872

CVE-2024-20872 affects Samsung TalkBackSE prior to Android 14. The issue is an improper handling of insufficient privileges that allows a local attacker to modify TalkBackSE settings. The vulnerability is local and does not require user interaction. PT-Security notes that updating to Android 14 o...

CVE-2024-20891

Affected software: SystemUI on Samsung Android devices prior to SMR Jul-2024 Release 1.Vulnerability: improper access control in launchFullscreenIntent; local attacker can launch privileged activities.Root cause/scope: access-control flaw in SystemUI component leading to privilege elevation.Impac...

CVE-2024-20898

The CVE-2024-20898 entry concerns Samsung Mobile devices, where the SoftphoneClient component of the IMS service uses implicit intents for sensitive communications. This design allows a local attacker to obtain sensitive information due to the exposure of signals via implicit intents in Softphone...

CVE-2024-34603

CVE-2024-34603 concerns Samsung Message with improper access control that could let a local attacker access location data. Affected: Samsung Message versions prior to SMR Jul-2024 Release 1. Root cause: insufficient access control enabling local data leakage (location). Impact: exposure of locati...

CVE-2024-34648

CVE-2024-34648 concerns Samsung KnoxMiscPolicy where improper handling of insufficient permissions in KnoxMiscPolicy prior to SMR Sep-2024 Release 1 allows local attackers to access sensitive data. Affected component: KnoxMiscPolicy on Samsung mobile devices. Root cause: privilege insufficiency m...

CVE-2024-34654

Samsung My Files prior to SMR Sep-2024 Release 1 is affected by an improper export of an Android application component, allowing local attackers to access files with My Files’ privilege. The issue arises from component export that grants access beyond intended boundaries, enabling potential expos...

CVE-2025-20948

Summary : CVE-2025-20948 describes an out-of-bounds read in the enrollment with the cdsp frame secfr trustlet on Samsung devices, affecting versions prior to the SMR Apr-2025 Release 1. Impact : local privileged attackers could read out-of-bounds memory. Affected scope : Samsung mobile devices wi...

CVE-2025-20953

The CVE-2025-20953 vulnerability affects SmartManagerCN prior to SMR May-2025 Release 1, caused by improper access control that could allow local attackers to launch activities within SmartManagerCN. Technical details across connected sources confirm the affected component as SmartManagerCN softw...

CVE-2023-21439

CVE-2023-21439 concerns an improper input validation vulnerability in the Samsung UwbDataTxStatusEvent component. The issue affects Samsung Mobile devices prior to the SMR Feb-2023 Release 1, enabling attackers to launch certain activities due to malformed input handling. Public documents in conn...

CVE-2023-30686

CVE-2023-30686 describes an out-of-bounds write in ReqDataRaw within libsec-ril, affecting Samsung Mobile devices prior to SMR Aug-2023 Release 1. The issue permits a local attacker with low privileges and no user interaction to potentially execute arbitrary code, with impact on confidentiality, ...

CVE-2023-42538

The CVE-2023-42538 entry concerns the libsaped library (libsaped) with an issue in the saped_rec_silence function (often referred to as the saped rec silence function). The root cause is improper input validation, enabling local attackers to trigger an out-of-bounds read and write. Affected versi...

CVE-2024-20845

CVE-2024-20845 describes an out-of-bounds write vulnerability in libsavsac.so when releasing memory, allowing a local attacker to execute arbitrary code. Affected: libsavsac.so prior to SMR Apr-2024 Release 1. Root cause: memory release path triggers out-of-bounds write. Impact: local code execut...

CVE-2024-34588

The vulnerability CVE-2024-34588 affects librtp.so (librtp library) prior to SMR Jul-2024 Release 1, caused by improper input validation while parsing RTCP SR packets, enabling remote denial of service when a user interacts with the target. All sources point to this library as the affected compon...

CVE-2025-20938

Summary: CVE-2025-20938 affects SamsungContacts. The issue is an improper access control that lets local attackers access protected data. Affected are SamsungContacts versions prior to SMR Apr-2025 Release 1. The vendor indicates remediation via a security update; users should apply SMR Apr-2025 ...

CVE-2025-20991

CVE-2025-20991 affects Android Bluetooth components, where improper export of Android application components enables local attackers to make devices discoverable. The issue is tied to Samsung/Android deployments prior to SMR Jun-2025 Release 1. Root cause: improper component export in Bluetooth h...

CVE-2023-21442

CVE-2023-21442 affects the Runestone app. The vulnerability is due to improper access control in Runestone versions prior to 2.9.09.003 on Android R (11) and prior to 3.2.01.007 on Android S (12). Local attackers could obtain device location information. Remediation: upgrade to Runestone 2.9.09.0...

CVE-2023-21446

CVE-2023-21446 involves Samsung MyFiles where improper input validation prior to versions 12.2.09 (Android R/11), 13.1.03.501 (Android S/12), and 14.1.00.422 (Android T/13) allows a local attacker to access MyFiles data. The affected component is MyFiles, with the root cause being input validatio...

CVE-2023-42559

CVE-2023-42559 affects Samsung Knox Guard on Samsung mobile devices. The root cause is improper exception management that enables a lock bypass by changing the system time, prior to SMR Dec-2023 Release 1. Impact is primarily confidentiality (high) with low integrity, and no availability impact. ...

CVE-2023-42570

The issue CVE-2023-42570 is an improper access control vulnerability in Samsung’s KnoxCustomManagerService. It affects Samsung Mobile devices and allows a local attacker to access the device SIM PIN before the SMR Dec-2023 Release 1 patch. Root cause stated as improper access control on the KnoxC...

CVE-2024-20813

CVE-2024-20813 is an Out-of-bounds write in padmd_vld_qtbl, within the libpadm.so component. The vulnerability affects libpadm.so prior to the Samsung SMR Feb-2024 Release 1, enabling a local attacker to execute arbitrary code via the padmd_vld_qtbl path. The issue is confirmed in multiple source...

CVE-2024-20889

The CVE-2024-20889 entry concerns Samsung Mobile devices (BLE) with improper authentication prior to SMR Jul-2024 Release 1, allowing adjacent attackers to pair with devices. Root cause: BLE pairing lacks proper authentication in affected builds. Impact: adjacent, unauthenticated pairing could en...

CVE-2024-34587

CVE-2024-34587 refers to improper input validation in the RTCP parsing logic of librtp.so present in affected Samsung Mobile software prior to the SMR Jul-2024 Release 1. The vulnerability allows remote attackers to execute arbitrary code with system privileges, with user interaction required to ...

CVE-2024-34602

CVE-2024-34602 concerns Samsung Messages prior to SMR Jul-2024 Release 1, where the use of implicit intents for sensitive communications can allow a local attacker to access sensitive information. The issue requires user interaction to trigger and is rooted in how intents expose sensitive data. A...

CVE-2024-34646

CVE-2024-34646 affects DualDarManagerProxy in Samsung Mobile devices prior to SMR Sep-2024 Release 1. The connected sources describe an improper access control vulnerability in that component, enabling local attackers to cause a local permanent denial of service. The issue is tied to the DualDarM...

CVE-2024-34662

CVE-2024-34662 involves improper access control in Android’s ActivityManager. The issue affects select Android 12 and 13 earlier than SMR Oct-2024 Release 1, and select Android 14 earlier than SMR Sep-2024 Release 1, enabling local attackers to perform privileged actions. Mitigation is via update...

CVE-2024-34665

CVE-2024-34665 describes an out-of-bounds write in parsing the h.264 format within the vulnerable component librtppayload.so on Samsung Mobile devices, prior to SMR Oct-2024 Release 1. The flaw allows remote code execution with system privileges, with user interaction required to trigger. Connect...

CVE-2025-20903

CVE-2025-20903 describes an improper access control flaw in Samsung’s SecSettingsIntelligence prior to the SMR March-2025 Release 1. The issue allows local attackers to perform privileged activities, with user interaction required to trigger the vulnerability. The CVSS 3.1 vector indicates local ...

CVE-2025-20908

CVE-2025-20908 affects Auracast prior to the Samsung SMR Mar‑2025 Release 1. The issue arises from the use of insufficiently random values , enabling an adjacent attacker to access Auracast broadcasting. According to the public records, the CVSS v3.1 base score is 6.5 (Medium) with Attack Vector:...

CVE-2025-20987

The CVE-2025-20987 issue is tied to fingerprint trustlet on Samsung devices, where improper access control allows local privileged attackers to obtain an auth_token. According to PT-2025-23749 (Fingerprint trustlet) and related sources, affected versions are before SMR May-2025 Release 1. The roo...

CVE-2023-21426

The CVE-2023-21426 vulnerability affects Samsung mobile devices running SMR prior to Jan-2023 Release 1, where a hardcoded AES key is used to encrypt card emulation PINs in NFC. The root cause is the hardcoded key in the NFC card emulation workflow, enabling local attackers to access cardemulatio...

CVE-2024-34593

CVE-2024-34593 affects librtp.so prior to SMR Jul-2024 Release 1. The issue is improper input validation during parsing/distribution of RTCP packets, enabling remote code execution with system privileges. User interaction is required to trigger exploitation. According to PT-2024-26008, remediatio...

CVE-2024-34668

CVE-2024-34668 describes an out-of-bounds write in parsing the h.263 format in the library file librtppayload.so prior to SMR Oct-2024 Release 1 , enabling remote code execution with system privileges. Exploitation requires user interaction . Samsung advises updating to SMR Oct-2024 Release 1 or ...

CVE-2024-34669

The CVE-2024-34669 issue is an out-of-bounds write in parsing the h.263+ format inside librtppayload.so, affecting Samsung Mobile devices prior to SMR Oct-2024 Release 1. Exploitation could allow remote code execution with system privileges, and the attack requires user interaction. Public detail...

CVE-2024-34674

CVE-2024-34674 affects Samsung Mobile Contacts prior to SMR Nov-2024 Release 1, with an improper access control flaw that could allow a physical attacker to access data across multiple user profiles. The NVD entry cites a CVSSv3.1 base score of 4.6 (MEDIUM) with high confidentiality impact. Publi...

CVE-2025-20993

The CVE-2025-20993 entry concerns libsecimaging.camera.samsung.so with an out-of-bounds write, enabling local attackers to write memory past bounds. Affected: libsecimaging.camera.samsung.so prior to SMR Jun-2025 Release 1. Root cause described as an out-of-bounds write; impact is local memory ma...

CVE-2026-20982

CVE-2026-20982 describes a path traversal vulnerability in ShortcutService prior to SMR Feb-2026 Release 1. The flaw allows a privileged local attacker to create files with system privileges. Affected component is Samsung’s ShortcutService; impact includes potential integrity and confidentiality ...

CVE-2023-21425

Technical details about CVE-2023-21425 are not publicly available in the provided documents. Monitor for updates from vendors and security bulletins.

CVE-2023-30649

CVE-2023-30649 affects Samsung RILD (RmtUimNeedApdu) with a heap out-of-bounds write that allows arbitrary code execution. In the PT-2023-22843 advisory, impacted versions are RILD prior to SMR Jul-2023 Release 1. The issue originates from a heap out-of-bounds write in the RmtUimNeedApdu function...

CVE-2023-30712

The CVE-2023-30712 vulnerability is reported for Samsung Mobile devices, arising from improper input validation in Settings Suggestions before SMR Sep-2023 Release 1. It allows an attacker with local access to trigger arbitrary activity via the Settings Suggestions component (root cause: input va...

CVE-2023-30727

CVE-2023-30727 describes an improper access control vulnerability in Samsung SecSettings prior to SMR Oct-2023 Release 1. The issue allows an attacker to enable Wi‑Fi and connect to arbitrary networks without user interaction, affecting SecSettings components on affected Samsung mobile devices. T...

CVE-2023-42529

The CVE-2023-42529 vulnerability affects the libsec-ril component in Samsung Mobile devices. It is described as an out-of-bounds write that allows a local attacker to execute arbitrary code. The issue is reported to affect versions prior to the SMR Nov-2023 Release 1, with remediation guidance to...

CVE-2024-20849

The CVE-2024-20849 issue affects libsdffextractor, with an out-of-bounds write in the chunk parsing implementation. Versions prior to SMR Apr-2023 Release 1 are vulnerable and could allow local attackers to execute arbitrary code. The available connected document (PT-2024-18758) confirms the affe...

CVE-2024-20884

CVE-2024-20884 affects the getSemBatteryUsageStats function in BatteryStatsService. The issue is described as an incorrect use of a privileged API that could allow a local attacker to access privileged API calls. The vulnerability is associated with Samsung/Mobile platforms and is tied to the SMR...

CVE-2024-34589

CVE-2024-34589 affects librtp.so prior to SMR Jul-2024 Release 1, due to improper input validation when parsing RTCP RR packets. This can allow remote attackers to trigger a temporary denial of service, with user interaction required to trigger the condition. Affected component: librtp.so (RTCP R...

CVE-2024-34641

CVE-2024-34641 relates to Samsung Android devices where the FeliCaTest component improperly exports an Android application component. This allows local attackers to enable NFC configuration. Affected software is FeliCaTest prior to the SMR Sep-2024 Release 1. The issue's root cause is improper co...

CVE-2024-34666

CVE-2024-34666 describes an out-of-bounds write in the h.264 parsing path of librtppayload.so in Samsung Mobile firmware prior to SMR Oct-2024 Release 1. The underlying issue is a memory write beyond bounds when handling a specific mode of the H.264 stream, allowing remote attackers to execute ar...

CVE-2024-49401

CVE-2024-49401 affects Samsung Mobile devices using Settings Suggestions prior to SMR Nov-2024 Release 1. The issue is due to improper input validation in Settings Suggestions, enabling a local attacker with low privileges to perform privileged activities. Impact is described as potential local p...