CVE-2023-30712

The CVE-2023-30712 vulnerability is reported for Samsung Mobile devices, arising from improper input validation in Settings Suggestions before SMR Sep-2023 Release 1. It allows an attacker with local access to trigger arbitrary activity via the Settings Suggestions component (root cause: input va...

CVE-2023-30718

CVE-2023-30718 is an Android component exposure issue in WifiApAutoHotspotEnablingActivity. The vulnerability arises from improper export of the component, allowing a local attacker to change a device’s Auto Hotspot setting. Affected: Android/Samsung Mobile stack prior to SMR Sep-2023 Release 1. ...

CVE-2024-34586

The CVE-2024-34586 entry concerns Samsung Knox: Improper access control in KnoxCustomManagerService prior to SMR Jul‑2024 Release 1 may allow a local attacker to configure the Knox privacy policy. Affected software: KnoxCustomManagerService (Samsung mobile devices). Root cause: insufficient acces...

CVE-2024-34592

Summary: CVE-2024-34592 affects librtp.so prior to SMR Jul-2024 Release 1 due to improper input validation when parsing RTCP SDES packets. This can allow a remote attacker to trigger a temporary denial of service, with user interaction required. Affected versions: librtp.so before SMR Jul-2024 Re...

CVE-2024-34595

CVE-2024-34595 concerns Samsung Mobile/SystemUI prior to the SMR Jul-2024 Release 1. The vulnerability is due to improper access control in the clickAdapterItem of SystemUI, enabling a local attacker to launch privileged activities. Impact is described as high with local attack vector and no user...

CVE-2024-34644

The CVE-2024-34644 entry concerns Samsung ClothingDressroom (Dressroom) on Samsung Mobile devices. Affected component: Dressroom prior to SMR Sep-2024 Release 1. Root cause: improper access control in the item selection flow, enabling local attackers to access protected data. Conditions: user int...

CVE-2024-34666

CVE-2024-34666 describes an out-of-bounds write in the h.264 parsing path of librtppayload.so in Samsung Mobile firmware prior to SMR Oct-2024 Release 1. The underlying issue is a memory write beyond bounds when handling a specific mode of the H.264 stream, allowing remote attackers to execute ar...

CVE-2024-49401

CVE-2024-49401 affects Samsung Mobile devices using Settings Suggestions prior to SMR Nov-2024 Release 1. The issue is due to improper input validation in Settings Suggestions, enabling a local attacker with low privileges to perform privileged activities. Impact is described as potential local p...

CVE-2024-49414

Samsung mobile devices with Dex Mode prior to SMR Dec-2024 Release 1 are affected by an authentication bypass via an alternate path that can allow a physical attacker to temporarily access the device’s recent app list. The issue stems from an insecure authentication flow in Dex Mode, per the CVE-...

CVE-2025-20992

CVE-2025-20992 affects Samsung’s library libsecimaging.camera.samsung.so (pre‑SMR Feb‑2025 Release 1). The root cause is an out‑of‑bounds read, enabling a local attacker to read memory. Impacted component: libsecimaging.camera.samsung.so; affected context is Samsung Mobile/SMR releases prior to F...

CVE-2026-21059

Samsung Contacts (prior to SMR Aug-2026 Release 1) improperly exports Android application components, allowing local attackers with low privileges to delete files under the app's elevated privileges. CISA SSVC marks exploitation as "none"; no exploit code is known. Apply the SMR Aug-2026 Release ...

CVE-2026-21064

Technical details (affected product/component/root cause/fix) are not publicly available in the provided documents. Monitor for updates.

CVE-2023-21425

Technical details about CVE-2023-21425 are not publicly available in the provided documents. Monitor for updates from vendors and security bulletins.

CVE-2023-21429

Vulnerable component: Samsung ePDG. Issue stems from improper usage of implicit intent in ePDG prior to SMR JAN-2023 Release 1, enabling an attacker to access the SSID. Impact is limited to local access (per CVSS) with low confidentiality impact as described in the sources. Remediation: apply Sam...

CVE-2023-21503

CVE-2023-21503 affects the Shannon baseband, specifically the mm_LteInterRatManagement.c component, with a potential buffer overflow that could allow remote attackers to cause invalid memory access. The issue is associated with Shannon baseband prior to SMR May-2023 Release 1. Reported risk indic...

CVE-2023-21513

CVE-2023-21513 affects Samsung CC Mode prior to SMR Jun-2023 Release 1. The issue is an improper privilege management vulnerability in CC Mode that allows a physical attacker to manipulate the device into unexpected CC Mode behavior under specific conditions. Reported impact includes high confide...

CVE-2023-30653

The CVE-2023-30653 issue affects the sysinput HAL service, caused by an out-of-bounds read/write in the enableTspDevice function. Prior to SMR Jul-2023 Release 1, this vulnerability allows local attackers to execute arbitrary code. Affected software/versions are sysinput HAL service versions befo...

CVE-2023-30727

CVE-2023-30727 describes an improper access control vulnerability in Samsung SecSettings prior to SMR Oct-2023 Release 1. The issue allows an attacker to enable Wi‑Fi and connect to arbitrary networks without user interaction, affecting SecSettings components on affected Samsung mobile devices. T...

CVE-2023-30732

CVE-2023-30732 affects Samsung Mobile devices running the SMR Oct-2023 Release 1. It arises from improper access control in a system property, enabling a local attacker to obtain the CPU serial number. Remediation is to update to SMR Oct-2023 Release 1 or later (per listed advisories).

CVE-2023-42533

CVE-2023-42533 affects Samsung Mobile devices prior to SMR Nov-2023 Release 1. The root cause is improper input validation on the USB Gadget Interface, allowing a physical attacker to execute arbitrary code in the kernel. Impact is kernel compromise with high confidentiality, integrity, and avail...

CVE-2024-20812

CVE-2024-20812 affects Samsung Mobile devices via an out-of-bounds write in padmd_vld_htbl within libpadm.so. The flaw (padmd_vld_htbl in libpadm.so) enables a local attacker to execute arbitrary code. Root cause described as out-of-bounds write. Impact is local code execution with high potential...

CVE-2024-20884

CVE-2024-20884 affects the getSemBatteryUsageStats function in BatteryStatsService. The issue is described as an incorrect use of a privileged API that could allow a local attacker to access privileged API calls. The vulnerability is associated with Samsung/Mobile platforms and is tied to the SMR...

CVE-2024-34583

CVE-2024-34583 concerns improper access control in a system property on Samsung Mobile devices prior to SMR Jul-2024 Release 1. A local attacker could obtain a device identifier (confidentiality impact low). Connected sources indicate updates to fix the issue: Samsung/Android security updates (SM...

CVE-2024-34585

CVE-2024-34585 concerns improper access control in the Samsung Mobile SystemUI component, specifically the launchApp function. The vulnerability allows a local attacker to launch privileged activities due to insufficient access restrictions in SystemUI before the SMR Jul-2024 Release 1. The relat...

CVE-2024-34614

CVE-2024-34614: Out-of-bounds write in libsmat.so prior to SMR Aug-2024 Release 1 allows local attackers to execute arbitrary code. Affected: Samsung Mobile devices (libsmat.so). Root cause: out-of-bounds write in the library. Mitigation: apply SMR Aug-2024 Release 1 updates (or newer). Exploitat...

CVE-2024-34677

CVE-2024-34677 relates to a vulnerability in Samsung Mobile’s System UI prior to the SMR Nov-2024 Release 1. The issue enables local attackers to exploit a flaw in System UI to disclose sensitive information and to cause malicious apps to appear legitimate. The publicly documented affected compon...

CVE-2024-34678

CVE-2024-34678: An out-of-bounds write in libsapeextractor.so prior to SMR Nov-2024 Release 1 enables local attackers to cause memory corruption. Affected software is Samsung Mobile devices (libsapeextractor.so component). Impact per sources is memory corruption with local access required; no use...

CVE-2024-34679

CVE-2024-34679 affects Crane; versions prior to SMR Nov-2024 Release 1 are vulnerable due to incorrect default permissions, permitting local attackers to access files with the phone privilege. The issue is documented across multiple feeds (Red Hat, NVD, CNVD, etc.) and is addressed by updating Cr...

CVE-2024-49415

The CVE-2024-49415 issue is an Out-of-bounds write in the libsaped.so component (Monkey’s Audio decoder) on Samsung Android devices prior to SMR Dec-2024 Release 1. The underlying bug in saped_rec/sapedextractor can write beyond the allocated buffer, enabling remote code execution. Public discuss...

CVE-2025-20943

CVE-2025-20943 : Out-of-bounds write in the secfr trustlet (pre-SMR Apr-2025 Release 1) allows local privileged attackers to cause memory corruption. Affected: Samsung devices’ secfr trustlet prior to SMR Apr-2025 Release 1. Impact: local impact with memory corruption; exploitation status not det...

CVE-2023-21445

CVE-2023-21445 concerns an improper access control vulnerability in Samsung MyFiles. Affected platforms include Android R (11) versions prior to 12.2.09, Android S (12) prior to 13.1.03.501, and Android T (13) prior to 14.1.00.422. The flaw allows a local attacker to write a file with MyFiles pri...

CVE-2023-30663

CVE-2023-30663 describes an improper input validation vulnerability in the Samsung/libsec-ril component, specifically the OemPersonalizationSetLock function, which may allow a local attacker to perform an out-of-bounds write. The issue is tied to Samsung Mobile devices running the affected SMR Ju...

CVE-2023-30717

CVE-2023-30717 is a vulnerability in Samsung SVCAgent prior to the SMR Sep-2023 Release 1 that leads to exposure of unresettable identifiers. Data shows a local attack vector with low user interaction (CVSSv3.1: AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N; base score 3.3 from NVD; Samsung’s assessment in...

CVE-2024-20899

CVE-2024-20899 affects Samsung Mobile devices (IMS service, RCS function). The vulnerability stems from the use of implicit intents for sensitive communication in the RCS function, enabling local attackers to obtain sensitive information. Impact is described as local access with confidentiality e...

CVE-2024-20901

CVE-2024-20901 concerns libsaped prior to Samsung SMR Jul-2024 Release 1, with an improper input validation in copying data to the buffer cache that enables a local attacker to write out-of-bounds memory. Connected sources specify the affected component as libsaped and cite the local-privilege im...

CVE-2024-34652

The CVE-2024-34652 entry corresponds to an incorrect authorization issue in the kperfmon component of Samsung Mobile devices prior to SMR Sep-2024 Release 1. The vulnerability allows local attackers to access performance-related information, including app usage. Affected scope and root cause are ...

CVE-2023-21487

CVE-2023-21487 concerns Samsung devices’ Telephony framework. The issue is described as an improper access control vulnerability that enables a local attacker to change a call setting. The public description across sources confirms the target is the Telephony framework and that exploitation requi...

CVE-2023-30646

CVE-2023-30646 affects RILD, specifically the BroadcastSmsConfig component. The root cause is a heap out-of-bounds write, reported to permit attackers to execute arbitrary code. The vulnerability concerns RILD prior to Samsung Mobile SMR July-2023 Release 1; upgrading to SMR Jul-2023 Release 1 or...

CVE-2023-42556

CVE-2023-42556 affects Samsung Contacts prior to SMR Dec-2023 Release 1. The issue is due to improper usage of implicit intents in Contacts, enabling an attacker to obtain sensitive information. Affected component: Contacts (Samsung Mobile). Impact is limited to information disclosure; CVSS data ...

CVE-2023-42561

CVE-2023-42561 is a heap out-of-bounds write vulnerability in the bootloader prior to Samsung SMR Dec-2023 Release 1. The issue allows a physical attacker to execute arbitrary code. No exploitation details are provided in the documents. Samsung’s security bulletin references a December 2023 patch...

CVE-2024-20803

CVE-2024-20803 describes an improper authentication vulnerability in the Bluetooth pairing process on Samsung Mobile Devices prior to SMR Jan-2024 Release 1. The issue allows remote attackers to establish a pairing without user interaction, as documented by multiple sources (Red Hat, NVD, CNNVD, ...

CVE-2024-34639

The CVE-2024-34639 issue affects Samsung mobile devices’ Setupwizard component prior to SMR Aug-2024 Release 1. Root cause: improper handling of exceptional conditions, enabling a physical attacker to bypass validation. Impact (per sources): integrity could be affected by bypassing validation; ex...

CVE-2024-34642

CVE-2024-34642 involves improper authorization in Samsung One UI Home before SMR Sep-2024 Release 1. The issue allows physical attackers to temporarily access sensitive information by leveraging insufficient access control in the affected One UI Home component. Affected software is One UI Home (p...

CVE-2024-34649

CVE-2024-34649 describes an improper access control flaw in the Dex Mode of Samsung’s multitasking framework, before SMR Sep-2024 Release 1. The issue could allow a physical attacker to temporarily access an unlocked screen. Affected context is limited to Samsung Mobile devices with the Dex Mode/...

CVE-2024-34667

CVE-2024-34667 is an out-of-bounds write in parsing the h.265 format in librtppayload.so, affecting versions prior to SMR Oct-2024 Release 1. It allows remote code execution with system privileges and requires user interaction to trigger. Remediation: update to SMR Oct-2024 Release 1 or later; as...

CVE-2024-34673

CVE-2024-34673 concerns the Modem’s IpcProtocol with improper input validation, affecting versions prior to SMR Nov-2024 Release 1. The vulnerability enables a local attacker to trigger a Denial-of-Service. The PT-2024-26094 entry confirms the affected software family as Modem and specifies the v...

CVE-2024-34675

CVE-2024-34675 describes an improper access control in Dex Mode, prior to SMR Nov-2024 Release 1, that could allow a physical attacker to temporarily access an unlocked screen. The issue affects Dex Mode versions before the SMR Nov-2024 Release 1. Remediation per PT-2024-26096 and related advisor...

CVE-2024-34680

The CVE-2024-34680 issue affects Samsung Mobile’s WlanTest prior to SMR Nov-2024 Release 1, caused by the use of an implicit intent for sensitive communication. This allows a local attacker to obtain sensitive information from the device. Affected software: WlanTest (versions before SMR Nov-2024 ...

CVE-2025-20909

CVE-2025-20909 affects Samsung Settings (Settings service) prior to SMR Mar-2025 Release 1, where use of implicit intents for sensitive communication enables local attackers to access sensitive information. Root cause is implicit handling of sensitive data via intents within Settings, leading to ...

CVE-2025-20955

CVE-2025-20955 concerns Samsung Android SMR issues where NotificationHistoryImageProvider improperly exports components, enabling local attackers to access notification images. The vulnerability is described across multiple sources (NVD/Red Hat/CVE lists) as affecting Android components exported ...