CVE-2023-42561

CVE-2023-42561 is a heap out-of-bounds write vulnerability in the bootloader prior to Samsung SMR Dec-2023 Release 1. The issue allows a physical attacker to execute arbitrary code. No exploitation details are provided in the documents. Samsung’s security bulletin references a December 2023 patch...

CVE-2023-42564

The CVE-2023-42564 issue concerns Samsung Knox knoxcustom service. Affected software/hardware: Samsung mobile devices running Knoxcustom prior to the SMR Dec-2023 Release 1. Vulnerable component: knoxcustom service. Root cause: improper access control that enables a broadcast to be sent with syst...

CVE-2024-20815

The CVE-2024-20815 affects Auto Hotspot’s onCharacteristicReadRequest. Multiple authoritative sources (including PT-Security PT-2024-18722) describe an improper authentication vulnerability that lets adjacent attackers connect to a victim’s hotspot without user awareness. The issue is tied to Aut...

CVE-2024-20844

CVE-2024-20844 affects the libsavsac.so component. The root cause is an out-of-bounds write during parsing of remaining codewords in versions prior to SMR Apr-2024 Release 1, enabling a local attacker to execute arbitrary code. Remediation: update to SMR Apr-2024 Release 1 or later.

CVE-2024-20890

The CVE-2024-20890 entry concerns Samsung Mobile BLE prior to SMR Jul-2024 Release 1, where improper input validation in BLE can allow adjacent attackers to trigger abnormal behavior. Connected sources confirm the affected context is Samsung Mobile devices with BLE functioning, and the root cause...

CVE-2024-20901

CVE-2024-20901 concerns libsaped prior to Samsung SMR Jul-2024 Release 1, with an improper input validation in copying data to the buffer cache that enables a local attacker to write out-of-bounds memory. Connected sources specify the affected component as libsaped and cite the local-privilege im...

CVE-2024-34642

CVE-2024-34642 involves improper authorization in Samsung One UI Home before SMR Sep-2024 Release 1. The issue allows physical attackers to temporarily access sensitive information by leveraging insufficient access control in the affected One UI Home component. Affected software is One UI Home (p...

CVE-2024-34673

CVE-2024-34673 concerns the Modem’s IpcProtocol with improper input validation, affecting versions prior to SMR Nov-2024 Release 1. The vulnerability enables a local attacker to trigger a Denial-of-Service. The PT-2024-26094 entry confirms the affected software family as Modem and specifies the v...

CVE-2024-34682

CVE-2024-34682 corresponds to Samsung Mobile devices with an improper authorization flaw in Settings before SMR Nov-2024 Release 1. The issue allows a physical attacker in Maintenance Mode to access stored Wi‑Fi passwords. Affected component: Settings; root cause: improper authorization. Risk is ...

CVE-2025-20909

CVE-2025-20909 affects Samsung Settings (Settings service) prior to SMR Mar-2025 Release 1, where use of implicit intents for sensitive communication enables local attackers to access sensitive information. Root cause is implicit handling of sensitive data via intents within Settings, leading to ...

CVE-2025-20988

The CVE-2025-20988 issue is a local, out-of-bounds read in the Samsung fingerprint trustlet present in Samsung Mobile devices prior to SMR May-2025 Release 1. The root cause is an out-of-bounds access in the fingerprint trustlet, allowing a locally privileged attacker to read memory outside the i...

CVE-2025-20989

CVE-2025-20989 describes improper logging in the fingerprint trustlet prior to Samsung SMR May-2025 Release 1, enabling local privileged attackers to obtain the hmac_key. Affected component: fingerprint trustlet on Samsung devices using the SMR May-2025 Release 1 or earlier. Underlying issue: ins...

CVE-2026-21020

The CVE-2026-21020 issue relates to OmaCP (Android) where improper export of Android application components allows local attackers to trigger privileged functions. Affected component: OmaCP prior to SMR May-2026 Release 1. Root cause is improper export of components that exposes privileged functi...

CVE-2023-21420

Technical details for CVE-2023-21420 are not publicly available in the provided documents. The entries mention an externally controlled format string issue in STST TA with arbitrary code execution but do not specify products, versions, impact, or fixes. Monitor for updates.

CVE-2023-21421

CVE-2023-21421 concerns the KnoxCustomManagerService on Samsung devices prior to the SMR Jan-2023 Release 1. The issue arises from improper handling of insufficient permissions or privileges, enabling a local attacker with low privileges to access the device’s SIM PIN. The red flags indicate a lo...

CVE-2023-21500

The CVE-2023-21500 entry describes a double free validation issue in the mPOS TUI trustlet’s setPinPadImages function. Affected component: mPOS TUI trustlet prior to Samsung SMR May-2023 Release 1. Root cause: improper memory handling allows local attackers to access the trustlet memory. Impact i...

CVE-2023-30641

CVE-2023-30641 is an improper access control vulnerability in Samsung settings prior to the SMR Jul-2023 Release 1. The issue allows a physical attacker using a restricted user profile to access the device owner’s Google account data. Affected component: Settings (Samsung SMR Jul-2023 Release 1)....

CVE-2023-30656

CVE-2023-30656 concerns LSOItemData with an improper input validation flaw that could allow an attacker to launch certain activities. Technical details in connected documents identify LSOItemData as affected, with impact tied to improper input validation and a requirement that vulnerable versions...

CVE-2023-30716

CVE-2023-30716 affects SVCAgent prior to Samsung SMR Sep-2023 Release 1. Root cause is improper access control that can allow an attacker with local access to trigger certain commands. Impact is described as enabling command execution under local, low-complexity conditions. Remediation per connec...

CVE-2024-34638

The CVE-2024-34638 issue is tied to ThemeCenter on Samsung Mobile devices, arising from improper handling of exceptional conditions prior to SMR Sep-2024 Release 1. The vulnerability enables a local attacker to delete non-preloaded applications by abusing ThemeCenter’s faulty exception handling. ...

CVE-2024-34651

Samsung My Files on Samsung Mobile devices is affected by CVE-2024-34651 due to improper authorization that allows local attackers to access restricted data. The vulnerability affects My Files prior to the SMR Sep-2024 Release 1; remediation is to apply SMR Sep-2024 Release 1 or later updates. Co...

CVE-2024-34653

CVE-2024-34653 describes a path-traversal vulnerability in Samsung Mobile’s My Files prior to SMR Sep-2024 Release 1. The issue permits a physical attacker to access directories using My Files’ privileges, indicating a local/physical attack surface with impact on confidentiality but not integrity...

CVE-2024-49410

CVE-2024-49410 describes an out-of-bounds write in libswmfextractor.so, prior to Samsung SMR Dec-2024 Release 1, enabling a local attacker to execute arbitrary code. Affected component: libswmfextractor.so (pre-Release 1). Impact is local, with high potential for compromise as stated in the sourc...

CVE-2025-20959

CVE-2025-20959 concerns Samsung devices where the Wi‑Fi P2P service uses an implicit intent for sensitive communications. The root cause is exposure via implicit intents, enabling local attackers to access sensitive information. Reported impact includes confidentiality loss with local access (per...

CVE-2023-30709

CVE-2023-30709 concerns Samsung Dual Messenger: improper access control in prior to SMR Sep-2023 Release 1 allows local attackers to launch activities with system privileges. Affected software is Samsung Mobile firmware with Dual Messenger; root cause is insufficient access controls between conte...

CVE-2023-30710

CVE-2023-30710 affects Samsung Knox AI prior to the SMR Sep-2023 Release 1. The issue is an improper input validation vulnerability that enables local attackers with low privileges and no user interaction to gain privileged activities on affected devices. The root cause is input validation weakne...

CVE-2023-42565

Summary: CVE-2023-42565 affects Samsung Smart Clip prior to SMR Dec-2023 Release 1. The issue is an improper input validation vulnerability that enables local attackers with shell privileges to execute arbitrary code. The primary affected component is Smart Clip, with the root cause stated as inp...

CVE-2024-20843

The CVE-2024-20843 entry concerns Samsung mobile devices affected by an out-of-bound write vulnerability in the command parsing implementation of libIfaaCa, present in versions prior to the SMR Apr-2024 Release 1. The issue enables a locally privileged attacker to execute arbitrary code. The prov...

CVE-2024-20894

CVE-2024-20894 affects Samsung Secure Folder on devices with firmware before SMR Jul-2024 Release 1. It stems from improper handling of exceptional conditions, enabling a physical attacker to bypass authentication under certain conditions, with user interaction required to trigger. Affected due t...

CVE-2024-34615

CVE-2024-34615 concerns an out-of-bounds write in libsmat.so prior to the SMR Aug-2024 Release 1. The issue allows local attackers to cause memory corruption. Public sources consistently describe the affected component as libsmat.so and indicate versions prior to SMR Aug-2024 Release 1 are vulner...

CVE-2023-21454

CVE-2023-21454 affects Samsung Keyboard prior to SMR Mar-2023 Release 1. The issue is improper authorization that could let a physical attacker access a user’s text history on the lockscreen. Affected software: Samsung Keyboard; root cause: improper authorization. Impact described as exposure of ...

CVE-2023-21461

The CVE-2023-21461 entry concerns Samsung mobile devices with an improper authorization vulnerability in the Settings component AutoPowerOnOffConfirmDialog (before SMR Mar-2023 Release 1). The underlying issue allows a local attacker to turn the device off via an unprotected activity. Documented ...

CVE-2023-21502

CVE-2023-21502 affects the FactoryTest application prior to Samsung SMR May-2023 Release 1. Root cause is improper input validation, enabling local privilege escalation via debugging commands. Public details consistently describe local access requirements and privilege escalation; no remote/vecto...

CVE-2023-30655

CVE-2023-30655 is a vulnerability in Samsung SMR Jul-2023 Release 1 that affects the SCEPProfile module. It is caused by improper input validation in SCEPProfile, enabling local attackers to launch privileged activities. Connected documents identify the affected product scope as Samsung mobile de...

CVE-2023-30701

Summary: CVE-2023-30701 corresponds to a PendingIntent hijacking flaw in Samsung WifiGeofenceManager, affecting pre-SMR Aug-2023 Release 1. The issue enables a local attacker to gain arbitrary file access via hijacked PendingIntents. Public details in connected sources indicate the affected compo...

CVE-2023-42557

The CVE-2023-42557 issue affects libIfaaCa prior to Samsung SMR Dec-2023 Release 1. It is described as an out-of-bounds write that enables local attackers to execute arbitrary code. Affected software/component: libIfaaCa; root cause: out-of-bounds write; impact: local code execution with HIGH con...

CVE-2024-20806

CVE-2024-20806 concerns Samsung Mobile Devices, specifically an improper access control vulnerability in the Notification service. The issue allows a local attacker to access notification data prior to SMR Jan-2024 Release 1. Connected sources consistently describe the root cause as access contro...

CVE-2024-20816

CVE-2024-20816 involves an improper authentication vulnerability in Samsung Auto Hotspot’s onCharacteristicWriteRequest. The issue allows adjacent attackers to connect to a victim’s mobile hotspot without user awareness. Root cause: insufficient authentication checks on the public interface used ...

CVE-2024-34609

The CVE-2024-34609 entry refers to an improper access control issue in VoiceNoteService on Samsung mobile devices, allowing local attackers to bypass restrictions on starting services from the background. Red Hat and CVE catalogs corroborate the same description, tying the vulnerability to VoiceN...

CVE-2026-20977

CVE-2026-20977 concerns an improper access control in Samsung’s Emergency Sharing prior to the SMR Feb-2026 Release 1. Multiple sources (NVD, Red Hat, NCSC, CVE listings, Attackerkb, CVE list) consistently describe that local attackers can interrupt the service’s functioning due to weak access ma...

CVE-2026-21073

CVE-2026-21073 affects Galaxy Themes prior to the SMR Aug-2026 Release 1. Description: improper input validation could allow a physical attacker to launch arbitrary activity. CVSS v4.0 score is 5.2 (Medium) with Attack Vector: Physical, Attack Complexity: Low, Privileges Required: None, User Inte...

CVE-2023-21484

CVE-2023-21484 is an improper access control vulnerability in Samsung AppLock prior to the SMR May-2023 Release 1. The issue allows local attackers with low privileges to execute a privileged operation due to insufficient access checks. Affected component: AppLock (Samsung devices). Impact as des...

CVE-2023-21498

CVE-2023-21498 concerns Samsung’s mPOS TUI trustlet. The vulnerability is an improper input validation flaw in the function setPartnerTAInfo, which can allow a local attacker to overwrite trustlet memory. The issue is addressed in the SMR May-2023 Release 1 or later (per multiple sources in the c...

CVE-2023-42566

CVE-2023-42566 targets the libsavsvc component used in Samsung Mobile devices. The issue is described as an out-of-bounds write, with the root cause tied to libsavsvc prior to the SMR Dec-2023 Release 1. The documented impact is local code execution by attackers, with consequences described as ar...

CVE-2024-20873

The CVE-2024-20873 entry concerns an improper input validation vulnerability in the caminfo driver (Samsung Mobile) prior to the SMR Jun-2024 Release 1. The underlying issue allows local privileged attackers to result in a write out-of-bounds memory condition. Documents consistently describe the ...

CVE-2024-20881

CVE-2024-20881 affects chnactiv TA prior to SMR Jun-2024 Release 1. The issue is due to improper input validation, enabling local privileged attackers to potentially execute arbitrary code. The connected documents confirm the vulnerability description but do not provide explicit remediation steps...

CVE-2023-21488

CVE-2023-21488 affects Samsung Tips prior to SMR May-2023 Release 1. Root cause: improper access control allowing local attackers to launch arbitrary activities in Tips. Affected software: Tips (Samsung mobile devices) before the May-2023 update. Mitigation: upgrade to SMR May-2023 Release 1 or l...

CVE-2023-21495

CVE-2023-21495 concerns an improper access control bug in the Knox Enrollment Service on Samsung devices, prior to SMR May-2023 Release 1. The issue could allow an attacker to install a KSP app when device admin is set. Root cause: access control weakness in Knox Enrollment Service. Severity metr...

CVE-2023-30644

The CVE-2023-30644 entry concerns a stack out-of-bounds write in the CdmaSmsParser of the RILD component. Affected software is Samsung’s RILD prior to SMR Jul-2023 Release 1; the vulnerability could allow attackers to execute arbitrary code locally due to an out-of-bounds write. Remediation is to...

CVE-2023-30645

CVE-2023-30645 describes a heap out-of-bounds write in the RILD component, specifically in IpcRxIncomingCBMsg, capable of enabling arbitrary code execution. Affected software is Samsung Mobile’s RILD prior to the SMR Jul-2023 Release 1. Public sources confirm the issue and consistently recommend ...