CVE-2023-30732

CVE-2023-30732 affects Samsung Mobile devices running the SMR Oct-2023 Release 1. It arises from improper access control in a system property, enabling a local attacker to obtain the CPU serial number. Remediation is to update to SMR Oct-2023 Release 1 or later (per listed advisories).

CVE-2025-20958

CVE-2025-20958 affects UnifiedWFC (Samsung) with improper verification of intent by a broadcast receiver, enabling local attackers to manipulate VoWiFi behaviors. Public details in PT-2025-20043 describe UnifiedWFC versions prior to SMR May-2025 Release 1 as affected. Root cause: broadcast receiv...

CVE-2025-20985

CVE-2025-20985 affects Samsung ThemeManager on devices running before SMR Jun-2025 Release 1. The vulnerability arises from improper privilege management, enabling local privileged attackers to reuse trial items. Impact is described as local privilege escalation; exploitation details are not prov...

CVE-2025-20992

CVE-2025-20992 affects Samsung’s library libsecimaging.camera.samsung.so (pre‑SMR Feb‑2025 Release 1). The root cause is an out‑of‑bounds read, enabling a local attacker to read memory. Impacted component: libsecimaging.camera.samsung.so; affected context is Samsung Mobile/SMR releases prior to F...

CVE-2024-34595

CVE-2024-34595 concerns Samsung Mobile/SystemUI prior to the SMR Jul-2024 Release 1. The vulnerability is due to improper access control in the clickAdapterItem of SystemUI, enabling a local attacker to launch privileged activities. Impact is described as high with local attack vector and no user...

CVE-2024-34644

The CVE-2024-34644 entry concerns Samsung ClothingDressroom (Dressroom) on Samsung Mobile devices. Affected component: Dressroom prior to SMR Sep-2024 Release 1. Root cause: improper access control in the item selection flow, enabling local attackers to access protected data. Conditions: user int...

CVE-2024-34645

The CVE-2024-34645 issue is confirmed in ThemeCenter prior to the SMR Sep-2024 Release 1. It stems from improper input validation, enabling a physical attacker to install privileged applications. Evidence across connected docs (PT-2024-26064, Red Hat/NVD/NEWS references) identifies ThemeCenter as...

CVE-2023-21445

CVE-2023-21445 concerns an improper access control vulnerability in Samsung MyFiles. Affected platforms include Android R (11) versions prior to 12.2.09, Android S (12) prior to 13.1.03.501, and Android T (13) prior to 14.1.00.422. The flaw allows a local attacker to write a file with MyFiles pri...

CVE-2023-21503

CVE-2023-21503 affects the Shannon baseband, specifically the mm_LteInterRatManagement.c component, with a potential buffer overflow that could allow remote attackers to cause invalid memory access. The issue is associated with Shannon baseband prior to SMR May-2023 Release 1. Reported risk indic...

CVE-2023-21513

CVE-2023-21513 affects Samsung CC Mode prior to SMR Jun-2023 Release 1. The issue is an improper privilege management vulnerability in CC Mode that allows a physical attacker to manipulate the device into unexpected CC Mode behavior under specific conditions. Reported impact includes high confide...

CVE-2023-30653

The CVE-2023-30653 issue affects the sysinput HAL service, caused by an out-of-bounds read/write in the enableTspDevice function. Prior to SMR Jul-2023 Release 1, this vulnerability allows local attackers to execute arbitrary code. Affected software/versions are sysinput HAL service versions befo...

CVE-2023-30718

CVE-2023-30718 is an Android component exposure issue in WifiApAutoHotspotEnablingActivity. The vulnerability arises from improper export of the component, allowing a local attacker to change a device’s Auto Hotspot setting. Affected: Android/Samsung Mobile stack prior to SMR Sep-2023 Release 1. ...

CVE-2023-42533

CVE-2023-42533 affects Samsung Mobile devices prior to SMR Nov-2023 Release 1. The root cause is improper input validation on the USB Gadget Interface, allowing a physical attacker to execute arbitrary code in the kernel. Impact is kernel compromise with high confidentiality, integrity, and avail...

CVE-2023-42556

CVE-2023-42556 affects Samsung Contacts prior to SMR Dec-2023 Release 1. The issue is due to improper usage of implicit intents in Contacts, enabling an attacker to obtain sensitive information. Affected component: Contacts (Samsung Mobile). Impact is limited to information disclosure; CVSS data ...

CVE-2024-20803

CVE-2024-20803 describes an improper authentication vulnerability in the Bluetooth pairing process on Samsung Mobile Devices prior to SMR Jan-2024 Release 1. The issue allows remote attackers to establish a pairing without user interaction, as documented by multiple sources (Red Hat, NVD, CNNVD, ...

CVE-2024-20812

CVE-2024-20812 affects Samsung Mobile devices via an out-of-bounds write in padmd_vld_htbl within libpadm.so. The flaw (padmd_vld_htbl in libpadm.so) enables a local attacker to execute arbitrary code. Root cause described as out-of-bounds write. Impact is local code execution with high potential...

CVE-2024-34583

CVE-2024-34583 concerns improper access control in a system property on Samsung Mobile devices prior to SMR Jul-2024 Release 1. A local attacker could obtain a device identifier (confidentiality impact low). Connected sources indicate updates to fix the issue: Samsung/Android security updates (SM...

CVE-2024-34586

The CVE-2024-34586 entry concerns Samsung Knox: Improper access control in KnoxCustomManagerService prior to SMR Jul‑2024 Release 1 may allow a local attacker to configure the Knox privacy policy. Affected software: KnoxCustomManagerService (Samsung mobile devices). Root cause: insufficient acces...

CVE-2024-34591

The connected PT-2024-26006 entry confirms a concrete vulnerability in librtp.so (pre-SMR Jul-2024 Release 1) related to improper input validation when parsing item data from RTCP SDES packets. The root cause is input validation weaknesses in the RTCP SDES item parsing, which can be exploited rem...

CVE-2024-34678

CVE-2024-34678: An out-of-bounds write in libsapeextractor.so prior to SMR Nov-2024 Release 1 enables local attackers to cause memory corruption. Affected software is Samsung Mobile devices (libsapeextractor.so component). Impact per sources is memory corruption with local access required; no use...

CVE-2024-49414

Samsung mobile devices with Dex Mode prior to SMR Dec-2024 Release 1 are affected by an authentication bypass via an alternate path that can allow a physical attacker to temporarily access the device’s recent app list. The issue stems from an insecure authentication flow in Dex Mode, per the CVE-...

CVE-2025-20943

CVE-2025-20943 : Out-of-bounds write in the secfr trustlet (pre-SMR Apr-2025 Release 1) allows local privileged attackers to cause memory corruption. Affected: Samsung devices’ secfr trustlet prior to SMR Apr-2025 Release 1. Impact: local impact with memory corruption; exploitation status not det...

CVE-2026-21023

The vulnerability CVE-2026-21023 affects PackageManagerService prior to SMR Mar-2026 Release 1, enabling local attackers to modify installation restrictions on specific apps. Root cause: insufficient verification of data authenticity in PackageManagerService. Impact per the sources: trivial local...

CVE-2023-21429

Vulnerable component: Samsung ePDG. Issue stems from improper usage of implicit intent in ePDG prior to SMR JAN-2023 Release 1, enabling an attacker to access the SSID. Impact is limited to local access (per CVSS) with low confidentiality impact as described in the sources. Remediation: apply Sam...

CVE-2023-21435

CVE-2023-21435 concerns the Samsung Fingerprint TA prior to the SMR Feb-2023 Release 1. The issue, described across multiple sources, is an information-disclosure flaw where an attacker could access memory address information via device logging. The vulnerability affects the Fingerprint TA compon...

CVE-2023-21486

CVE-2023-21486 concerns an improper export of Android components in ImagePreviewActivity within Samsung Call Settings, enabling a physical attacker to access certain media data in sandbox. The issue is tied to specific Samsung SMR May-2023 Release 1 updates; remediation is provided via the May-20...

CVE-2023-21487

CVE-2023-21487 concerns Samsung devices’ Telephony framework. The issue is described as an improper access control vulnerability that enables a local attacker to change a call setting. The public description across sources confirms the target is the Telephony framework and that exploitation requi...

CVE-2023-30717

CVE-2023-30717 is a vulnerability in Samsung SVCAgent prior to the SMR Sep-2023 Release 1 that leads to exposure of unresettable identifiers. Data shows a local attack vector with low user interaction (CVSSv3.1: AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N; base score 3.3 from NVD; Samsung’s assessment in...

CVE-2023-42561

CVE-2023-42561 is a heap out-of-bounds write vulnerability in the bootloader prior to Samsung SMR Dec-2023 Release 1. The issue allows a physical attacker to execute arbitrary code. No exploitation details are provided in the documents. Samsung’s security bulletin references a December 2023 patch...

CVE-2024-20815

The CVE-2024-20815 affects Auto Hotspot’s onCharacteristicReadRequest. Multiple authoritative sources (including PT-Security PT-2024-18722) describe an improper authentication vulnerability that lets adjacent attackers connect to a victim’s hotspot without user awareness. The issue is tied to Aut...

CVE-2024-20844

CVE-2024-20844 affects the libsavsac.so component. The root cause is an out-of-bounds write during parsing of remaining codewords in versions prior to SMR Apr-2024 Release 1, enabling a local attacker to execute arbitrary code. Remediation: update to SMR Apr-2024 Release 1 or later.

CVE-2024-20899

CVE-2024-20899 affects Samsung Mobile devices (IMS service, RCS function). The vulnerability stems from the use of implicit intents for sensitive communication in the RCS function, enabling local attackers to obtain sensitive information. Impact is described as local access with confidentiality e...

CVE-2024-20901

CVE-2024-20901 concerns libsaped prior to Samsung SMR Jul-2024 Release 1, with an improper input validation in copying data to the buffer cache that enables a local attacker to write out-of-bounds memory. Connected sources specify the affected component as libsaped and cite the local-privilege im...

CVE-2024-34585

CVE-2024-34585 concerns improper access control in the Samsung Mobile SystemUI component, specifically the launchApp function. The vulnerability allows a local attacker to launch privileged activities due to insufficient access restrictions in SystemUI before the SMR Jul-2024 Release 1. The relat...

CVE-2024-34592

Summary: CVE-2024-34592 affects librtp.so prior to SMR Jul-2024 Release 1 due to improper input validation when parsing RTCP SDES packets. This can allow a remote attacker to trigger a temporary denial of service, with user interaction required. Affected versions: librtp.so before SMR Jul-2024 Re...

CVE-2024-34614

CVE-2024-34614: Out-of-bounds write in libsmat.so prior to SMR Aug-2024 Release 1 allows local attackers to execute arbitrary code. Affected: Samsung Mobile devices (libsmat.so). Root cause: out-of-bounds write in the library. Mitigation: apply SMR Aug-2024 Release 1 updates (or newer). Exploitat...

CVE-2024-34639

The CVE-2024-34639 issue affects Samsung mobile devices’ Setupwizard component prior to SMR Aug-2024 Release 1. Root cause: improper handling of exceptional conditions, enabling a physical attacker to bypass validation. Impact (per sources): integrity could be affected by bypassing validation; ex...

CVE-2024-34652

The CVE-2024-34652 entry corresponds to an incorrect authorization issue in the kperfmon component of Samsung Mobile devices prior to SMR Sep-2024 Release 1. The vulnerability allows local attackers to access performance-related information, including app usage. Affected scope and root cause are ...

CVE-2024-34667

CVE-2024-34667 is an out-of-bounds write in parsing the h.265 format in librtppayload.so, affecting versions prior to SMR Oct-2024 Release 1. It allows remote code execution with system privileges and requires user interaction to trigger. Remediation: update to SMR Oct-2024 Release 1 or later; as...

CVE-2024-34677

CVE-2024-34677 relates to a vulnerability in Samsung Mobile’s System UI prior to the SMR Nov-2024 Release 1. The issue enables local attackers to exploit a flaw in System UI to disclose sensitive information and to cause malicious apps to appear legitimate. The publicly documented affected compon...

CVE-2025-20909

CVE-2025-20909 affects Samsung Settings (Settings service) prior to SMR Mar-2025 Release 1, where use of implicit intents for sensitive communication enables local attackers to access sensitive information. Root cause is implicit handling of sensitive data via intents within Settings, leading to ...

CVE-2025-20955

CVE-2025-20955 concerns Samsung Android SMR issues where NotificationHistoryImageProvider improperly exports components, enabling local attackers to access notification images. The vulnerability is described across multiple sources (NVD/Red Hat/CVE lists) as affecting Android components exported ...

CVE-2023-30646

CVE-2023-30646 affects RILD, specifically the BroadcastSmsConfig component. The root cause is a heap out-of-bounds write, reported to permit attackers to execute arbitrary code. The vulnerability concerns RILD prior to Samsung Mobile SMR July-2023 Release 1; upgrading to SMR Jul-2023 Release 1 or...

CVE-2023-30663

CVE-2023-30663 describes an improper input validation vulnerability in the Samsung/libsec-ril component, specifically the OemPersonalizationSetLock function, which may allow a local attacker to perform an out-of-bounds write. The issue is tied to Samsung Mobile devices running the affected SMR Ju...

CVE-2023-30671

CVE-2023-30671 is a logic-error vulnerability in Samsung Mobile software affecting the package installation path via adb, enabling a local attacker to downgrade an installed application. The issue is described across multiple sources as a local-privilege issue with high impact on integrity and lo...

CVE-2023-42535

CVE-2023-42535 affects Samsung Mobile devices via an out-of-bounds write in the vold module’s read_block function, enabling a local attacker to execute arbitrary code. The issue is tied to Samsung’s pre-SMR Nov-2023 Release 1 patch level, with multiple sources confirming a local-exploit scenario ...

CVE-2024-34675

CVE-2024-34675 describes an improper access control in Dex Mode, prior to SMR Nov-2024 Release 1, that could allow a physical attacker to temporarily access an unlocked screen. The issue affects Dex Mode versions before the SMR Nov-2024 Release 1. Remediation per PT-2024-26096 and related advisor...

CVE-2024-34680

The CVE-2024-34680 issue affects Samsung Mobile’s WlanTest prior to SMR Nov-2024 Release 1, caused by the use of an implicit intent for sensitive communication. This allows a local attacker to obtain sensitive information from the device. Affected software: WlanTest (versions before SMR Nov-2024 ...

CVE-2024-34682

CVE-2024-34682 corresponds to Samsung Mobile devices with an improper authorization flaw in Settings before SMR Nov-2024 Release 1. The issue allows a physical attacker in Maintenance Mode to access stored Wi‑Fi passwords. Affected component: Settings; root cause: improper authorization. Risk is ...

CVE-2024-49415

The CVE-2024-49415 issue is an Out-of-bounds write in the libsaped.so component (Monkey’s Audio decoder) on Samsung Android devices prior to SMR Dec-2024 Release 1. The underlying bug in saped_rec/sapedextractor can write beyond the allocated buffer, enabling remote code execution. Public discuss...