CVE-2023-21423

CVE-2023-21423 affects Samsung ChnFileShareKit prior to SMR Jan-2023 Release 1. The root cause is improper authorization, enabling an attacker to control BLE advertising without permission via an unprotected action. Impact is described as local control with confidentiality and integrity implicati...

CVE-2023-21449

The CVE-2023-21449 entry concerns the Samsung Call application with improper access control, enabling local attackers to access sensitive information without permission. Affected component is the Call application (prior to SMR Mar-2023 Release 1); root cause is improper access control. Public det...

CVE-2023-30706

CVE-2023-30706 affects Samsung Keyboard prior to SMR Sep-2023 Release 1, where improper authorization could allow a user with system privileges to read arbitrary files. The issue is tied to Samsung Keyboard in Samsung mobile devices; root cause described as improper authorization. Impact stated i...

CVE-2023-30720

CVE-2023-30720 describes a PendingIntent hijacking vulnerability in Samsung Mobile devices’ LmsAssemblyTrackerCTC, exploitable by a local attacker to gain arbitrary file access. The issue affects LmsAssemblyTrackerCTC prior to the SMR Sep-2023 Release 1. The root cause is improper PendingIntent h...

CVE-2024-34603

CVE-2024-34603 concerns Samsung Message with improper access control that could let a local attacker access location data. Affected: Samsung Message versions prior to SMR Jul-2024 Release 1. Root cause: insufficient access control enabling local data leakage (location). Impact: exposure of locati...

CVE-2024-34662

CVE-2024-34662 involves improper access control in Android’s ActivityManager. The issue affects select Android 12 and 13 earlier than SMR Oct-2024 Release 1, and select Android 14 earlier than SMR Sep-2024 Release 1, enabling local attackers to perform privileged actions. Mitigation is via update...

CVE-2025-20948

Summary : CVE-2025-20948 describes an out-of-bounds read in the enrollment with the cdsp frame secfr trustlet on Samsung devices, affecting versions prior to the SMR Apr-2025 Release 1. Impact : local privileged attackers could read out-of-bounds memory. Affected scope : Samsung mobile devices wi...

CVE-2025-20952

Summary of CVE-2025-20952 (Samsung Mdecservice) : Affected component is Mdecservice prior to SMR Apr-2025 Release 1. The vulnerability is due to improper access control, enabling local attackers to access arbitrary files with system privilege. Evidence across sources confirms the issue exists in ...

CVE-2025-20953

The CVE-2025-20953 vulnerability affects SmartManagerCN prior to SMR May-2025 Release 1, caused by improper access control that could allow local attackers to launch activities within SmartManagerCN. Technical details across connected sources confirm the affected component as SmartManagerCN softw...

CVE-2025-20987

The CVE-2025-20987 issue is tied to fingerprint trustlet on Samsung devices, where improper access control allows local privileged attackers to obtain an auth_token. According to PT-2025-23749 (Fingerprint trustlet) and related sources, affected versions are before SMR May-2025 Release 1. The roo...

CVE-2026-20982

CVE-2026-20982 describes a path traversal vulnerability in ShortcutService prior to SMR Feb-2026 Release 1. The flaw allows a privileged local attacker to create files with system privileges. Affected component is Samsung’s ShortcutService; impact includes potential integrity and confidentiality ...

CVE-2023-30654

CVE-2023-30654 concerns Samsung Mobile devices and targets the SLocationService race for location data. The vulnerability is an improper access control in SLocationService prior to the SMR Aug-2023 Release 1, which allows a local attacker to update a fake location. The documented impact indicates...

CVE-2024-20833

The CVE-2024-20833 entry describes a use-after-free issue in the Samsung Mobile software component pub_crypto_recv_msg , triggered by a race condition prior to the SMR Mar-2024 Release 1. The vulnerability allows local attackers with system privilege to cause memory corruption. Documents consiste...

CVE-2024-20891

Affected software: SystemUI on Samsung Android devices prior to SMR Jul-2024 Release 1.Vulnerability: improper access control in launchFullscreenIntent; local attacker can launch privileged activities.Root cause/scope: access-control flaw in SystemUI component leading to privilege elevation.Impac...

CVE-2024-34646

CVE-2024-34646 affects DualDarManagerProxy in Samsung Mobile devices prior to SMR Sep-2024 Release 1. The connected sources describe an improper access control vulnerability in that component, enabling local attackers to cause a local permanent denial of service. The issue is tied to the DualDarM...

CVE-2024-34654

Samsung My Files prior to SMR Sep-2024 Release 1 is affected by an improper export of an Android application component, allowing local attackers to access files with My Files’ privilege. The issue arises from component export that grants access beyond intended boundaries, enabling potential expos...

CVE-2023-21439

CVE-2023-21439 concerns an improper input validation vulnerability in the Samsung UwbDataTxStatusEvent component. The issue affects Samsung Mobile devices prior to the SMR Feb-2023 Release 1, enabling attackers to launch certain activities due to malformed input handling. Public documents in conn...

CVE-2023-21442

CVE-2023-21442 affects the Runestone app. The vulnerability is due to improper access control in Runestone versions prior to 2.9.09.003 on Android R (11) and prior to 3.2.01.007 on Android S (12). Local attackers could obtain device location information. Remediation: upgrade to Runestone 2.9.09.0...

CVE-2023-30686

CVE-2023-30686 describes an out-of-bounds write in ReqDataRaw within libsec-ril, affecting Samsung Mobile devices prior to SMR Aug-2023 Release 1. The issue permits a local attacker with low privileges and no user interaction to potentially execute arbitrary code, with impact on confidentiality, ...

CVE-2024-20872

CVE-2024-20872 affects Samsung TalkBackSE prior to Android 14. The issue is an improper handling of insufficient privileges that allows a local attacker to modify TalkBackSE settings. The vulnerability is local and does not require user interaction. PT-Security notes that updating to Android 14 o...

CVE-2024-34587

CVE-2024-34587 refers to improper input validation in the RTCP parsing logic of librtp.so present in affected Samsung Mobile software prior to the SMR Jul-2024 Release 1. The vulnerability allows remote attackers to execute arbitrary code with system privileges, with user interaction required to ...

CVE-2024-34602

CVE-2024-34602 concerns Samsung Messages prior to SMR Jul-2024 Release 1, where the use of implicit intents for sensitive communications can allow a local attacker to access sensitive information. The issue requires user interaction to trigger and is rooted in how intents expose sensitive data. A...

CVE-2024-34641

CVE-2024-34641 relates to Samsung Android devices where the FeliCaTest component improperly exports an Android application component. This allows local attackers to enable NFC configuration. Affected software is FeliCaTest prior to the SMR Sep-2024 Release 1. The issue's root cause is improper co...

CVE-2024-34665

CVE-2024-34665 describes an out-of-bounds write in parsing the h.264 format within the vulnerable component librtppayload.so on Samsung Mobile devices, prior to SMR Oct-2024 Release 1. The flaw allows remote code execution with system privileges, with user interaction required to trigger. Connect...

CVE-2025-20903

CVE-2025-20903 describes an improper access control flaw in Samsung’s SecSettingsIntelligence prior to the SMR March-2025 Release 1. The issue allows local attackers to perform privileged activities, with user interaction required to trigger the vulnerability. The CVSS 3.1 vector indicates local ...

CVE-2025-20938

Summary: CVE-2025-20938 affects SamsungContacts. The issue is an improper access control that lets local attackers access protected data. Affected are SamsungContacts versions prior to SMR Apr-2025 Release 1. The vendor indicates remediation via a security update; users should apply SMR Apr-2025 ...

CVE-2023-21426

The CVE-2023-21426 vulnerability affects Samsung mobile devices running SMR prior to Jan-2023 Release 1, where a hardcoded AES key is used to encrypt card emulation PINs in NFC. The root cause is the hardcoded key in the NFC card emulation workflow, enabling local attackers to access cardemulatio...

CVE-2023-21446

CVE-2023-21446 involves Samsung MyFiles where improper input validation prior to versions 12.2.09 (Android R/11), 13.1.03.501 (Android S/12), and 14.1.00.422 (Android T/13) allows a local attacker to access MyFiles data. The affected component is MyFiles, with the root cause being input validatio...

CVE-2023-30649

CVE-2023-30649 affects Samsung RILD (RmtUimNeedApdu) with a heap out-of-bounds write that allows arbitrary code execution. In the PT-2023-22843 advisory, impacted versions are RILD prior to SMR Jul-2023 Release 1. The issue originates from a heap out-of-bounds write in the RmtUimNeedApdu function...

CVE-2023-42538

The CVE-2023-42538 entry concerns the libsaped library (libsaped) with an issue in the saped_rec_silence function (often referred to as the saped rec silence function). The root cause is improper input validation, enabling local attackers to trigger an out-of-bounds read and write. Affected versi...

CVE-2024-20813

CVE-2024-20813 is an Out-of-bounds write in padmd_vld_qtbl, within the libpadm.so component. The vulnerability affects libpadm.so prior to the Samsung SMR Feb-2024 Release 1, enabling a local attacker to execute arbitrary code via the padmd_vld_qtbl path. The issue is confirmed in multiple source...

CVE-2024-20845

CVE-2024-20845 describes an out-of-bounds write vulnerability in libsavsac.so when releasing memory, allowing a local attacker to execute arbitrary code. Affected: libsavsac.so prior to SMR Apr-2024 Release 1. Root cause: memory release path triggers out-of-bounds write. Impact: local code execut...

CVE-2024-20889

The CVE-2024-20889 entry concerns Samsung Mobile devices (BLE) with improper authentication prior to SMR Jul-2024 Release 1, allowing adjacent attackers to pair with devices. Root cause: BLE pairing lacks proper authentication in affected builds. Impact: adjacent, unauthenticated pairing could en...

CVE-2024-34668

CVE-2024-34668 describes an out-of-bounds write in parsing the h.263 format in the library file librtppayload.so prior to SMR Oct-2024 Release 1 , enabling remote code execution with system privileges. Exploitation requires user interaction . Samsung advises updating to SMR Oct-2024 Release 1 or ...

CVE-2024-34669

The CVE-2024-34669 issue is an out-of-bounds write in parsing the h.263+ format inside librtppayload.so, affecting Samsung Mobile devices prior to SMR Oct-2024 Release 1. Exploitation could allow remote code execution with system privileges, and the attack requires user interaction. Public detail...

CVE-2025-20993

The CVE-2025-20993 entry concerns libsecimaging.camera.samsung.so with an out-of-bounds write, enabling local attackers to write memory past bounds. Affected: libsecimaging.camera.samsung.so prior to SMR Jun-2025 Release 1. Root cause described as an out-of-bounds write; impact is local memory ma...

CVE-2023-42529

The CVE-2023-42529 vulnerability affects the libsec-ril component in Samsung Mobile devices. It is described as an out-of-bounds write that allows a local attacker to execute arbitrary code. The issue is reported to affect versions prior to the SMR Nov-2023 Release 1, with remediation guidance to...

CVE-2023-42559

CVE-2023-42559 affects Samsung Knox Guard on Samsung mobile devices. The root cause is improper exception management that enables a lock bypass by changing the system time, prior to SMR Dec-2023 Release 1. Impact is primarily confidentiality (high) with low integrity, and no availability impact. ...

CVE-2023-42570

The issue CVE-2023-42570 is an improper access control vulnerability in Samsung’s KnoxCustomManagerService. It affects Samsung Mobile devices and allows a local attacker to access the device SIM PIN before the SMR Dec-2023 Release 1 patch. Root cause stated as improper access control on the KnoxC...

CVE-2024-20849

The CVE-2024-20849 issue affects libsdffextractor, with an out-of-bounds write in the chunk parsing implementation. Versions prior to SMR Apr-2023 Release 1 are vulnerable and could allow local attackers to execute arbitrary code. The available connected document (PT-2024-18758) confirms the affe...

CVE-2024-34589

CVE-2024-34589 affects librtp.so prior to SMR Jul-2024 Release 1, due to improper input validation when parsing RTCP RR packets. This can allow remote attackers to trigger a temporary denial of service, with user interaction required to trigger the condition. Affected component: librtp.so (RTCP R...

CVE-2024-34591

The connected PT-2024-26006 entry confirms a concrete vulnerability in librtp.so (pre-SMR Jul-2024 Release 1) related to improper input validation when parsing item data from RTCP SDES packets. The root cause is input validation weaknesses in the RTCP SDES item parsing, which can be exploited rem...

CVE-2024-34593

CVE-2024-34593 affects librtp.so prior to SMR Jul-2024 Release 1. The issue is improper input validation during parsing/distribution of RTCP packets, enabling remote code execution with system privileges. User interaction is required to trigger exploitation. According to PT-2024-26008, remediatio...

CVE-2024-34645

The CVE-2024-34645 issue is confirmed in ThemeCenter prior to the SMR Sep-2024 Release 1. It stems from improper input validation, enabling a physical attacker to install privileged applications. Evidence across connected docs (PT-2024-26064, Red Hat/NVD/NEWS references) identifies ThemeCenter as...

CVE-2024-34674

CVE-2024-34674 affects Samsung Mobile Contacts prior to SMR Nov-2024 Release 1, with an improper access control flaw that could allow a physical attacker to access data across multiple user profiles. The NVD entry cites a CVSSv3.1 base score of 4.6 (MEDIUM) with high confidentiality impact. Publi...

CVE-2025-20908

CVE-2025-20908 affects Auracast prior to the Samsung SMR Mar‑2025 Release 1. The issue arises from the use of insufficiently random values , enabling an adjacent attacker to access Auracast broadcasting. According to the public records, the CVSS v3.1 base score is 6.5 (Medium) with Attack Vector:...

CVE-2025-20958

CVE-2025-20958 affects UnifiedWFC (Samsung) with improper verification of intent by a broadcast receiver, enabling local attackers to manipulate VoWiFi behaviors. Public details in PT-2025-20043 describe UnifiedWFC versions prior to SMR May-2025 Release 1 as affected. Root cause: broadcast receiv...

CVE-2025-20985

CVE-2025-20985 affects Samsung ThemeManager on devices running before SMR Jun-2025 Release 1. The vulnerability arises from improper privilege management, enabling local privileged attackers to reuse trial items. Impact is described as local privilege escalation; exploitation details are not prov...

CVE-2026-21023

The vulnerability CVE-2026-21023 affects PackageManagerService prior to SMR Mar-2026 Release 1, enabling local attackers to modify installation restrictions on specific apps. Root cause: insufficient verification of data authenticity in PackageManagerService. Impact per the sources: trivial local...

CVE-2023-30718

CVE-2023-30718 is an Android component exposure issue in WifiApAutoHotspotEnablingActivity. The vulnerability arises from improper export of the component, allowing a local attacker to change a device’s Auto Hotspot setting. Affected: Android/Samsung Mobile stack prior to SMR Sep-2023 Release 1. ...