CVE-2026-20977

CVE-2026-20977 concerns an improper access control in Samsung’s Emergency Sharing prior to the SMR Feb-2026 Release 1. Multiple sources (NVD, Red Hat, NCSC, CVE listings, Attackerkb, CVE list) consistently describe that local attackers can interrupt the service’s functioning due to weak access ma...

CVE-2023-30714

The CVE-2023-30714 issue affects Samsung One UI Home’s FolderContainerDragDelegate. It is an improper authorization vulnerability that, with physical access, permits changing some folder lock settings. Root cause: inadequate authorization checks in the FolderContainerDragDelegate component. Impac...

CVE-2023-42560

CVE-2023-42560 is a heap out-of-bounds write in dec_mono_audb within libsavsac.so, affecting Samsung Mobile prior to SMR Dec-2023 Release 1. The vulnerability allows arbitrary code execution and is documented across multiple sources (e.g., NVD/Red Hat/CVE listed, Samsung security advisories). Aff...

CVE-2024-20881

CVE-2024-20881 affects chnactiv TA prior to SMR Jun-2024 Release 1. The issue is due to improper input validation, enabling local privileged attackers to potentially execute arbitrary code. The connected documents confirm the vulnerability description but do not provide explicit remediation steps...

CVE-2024-34637

CVE-2024-34637 affects WindowManagerService in certain Android releases (Android 12 SMR Sep-2024 Release 1; Android 13/14 SMR Jun/Sep 2024 releases). The vulnerability is an improper access control that allows local attackers to bypass restrictions on starting services from the background. Connec...

CVE-2023-21485

CVE-2023-21485 describes an issue in Android/Samsung devices where the vulnerability occurs in the VideoPreviewActivity within Call Settings, allowing a physical attacker to access some media data stored in the device sandbox. The core problem is an improper export of Android application componen...

CVE-2023-21493

CVE-2023-21493 affects SemShareFileProvider prior to SMR May-2023 Release 1. The vulnerability is an improper access-control issue that enables local attackers to access protected data. Root cause is insufficient access restrictions on SemShareFileProvider components. Affected software is SemShar...

CVE-2023-21494

The CVE-2023-21494 issue affects Samsung Shannon baseband, specifically the auth API in mm_Authentication.c. It describes a potential buffer overflow that could allow remote attackers to cause invalid memory access. The vulnerability is rooted in the Shannon baseband code prior to SMR May-2023 Re...

CVE-2023-30699

CVE-2023-30699 is an out-of-bounds write vulnerability in the libsimba library’s parser_hvcC function, affecting Samsung mobile devices prior to SMR Aug-2023 Release 1. The issue allows remote code execution and has been addressed in the SMR Aug-2023 Release 1 or later. Connected sources indicate...

CVE-2023-30707

CVE-2023-30707 affects Samsung Keyboard, specifically the FileProviderStatusReceiver component. The root cause is improper input validation, as described in the CVE entry and supported by PT-2023-22907, affecting Samsung Keyboard versions prior to SMR Sep-2023 Release 1. The practical impact is t...

CVE-2023-42566

CVE-2023-42566 targets the libsavsvc component used in Samsung Mobile devices. The issue is described as an out-of-bounds write, with the root cause tied to libsavsvc prior to the SMR Dec-2023 Release 1. The documented impact is local code execution by attackers, with consequences described as ar...

CVE-2024-34676

CVE-2024-34676 involves an out-of-bounds write in the subtitle file parser (libsubextractor.so) on Samsung Mobile devices, enabling local memory corruption with user interaction required. Affected component: libsubextractor.so subtitle parsing; trigger: malformed subtitle input; root cause: out-o...

CVE-2023-21501

The CVE-2023-21501 entry concerns Samsung mobile devices where an improper input validation vulnerability in the mPOS fiserve trustlet (pre-SMR May-2023 Release 1) permits a local attacker to execute arbitrary code. Affected component: mPOS fiserve trustlet; root cause: inadequate input validatio...

CVE-2023-42568

CVE-2023-42568 affects SmartManagerCN prior to SMR Dec-2023 Release 1. The root cause is improper access control, enabling local attackers to access arbitrary files with system privileges. Public records in NVD/Red Hat/PRION reinforce the same impact and 해당 Samsung advisories reference SMR Dec-20...

CVE-2024-20877

Summary: CVE-2024-20877 appears in multiple feeds as a heap out-of-bounds write vulnerability in the grid image header parsing of libsavscmn.so, prior to Samsung SMR Jun-2024 Release 1, enabling local arbitrary code execution. Documents confirm the affected component and impact (local code execut...

CVE-2024-34619

CVE-2024-34619 affects librtp.so (versions prior to SMR Aug-2024 Release 1). The issue is improper input validation that allows remote code execution with system privileges. Trigger requires user interaction. Remediation: update to SMR Aug-2024 Release 1 or later. Public exploit details are not p...

CVE-2024-34643

CVE-2024-34643 affects Samsung Mobile Dressroom components prior to SMR Sep-2024 Release 1. The issue is an improper access control in a key input related function, enabling local attackers to access protected data once user interaction triggers the vulnerability. Impact details in sources indica...

CVE-2026-20972

CVE-2026-20972 corresponds to Samsung’s SVE-2025-2255. Description: Improper Export of Android Application Components in UwbTest prior to SMR Jan-2026 Release 1 allows local attackers to enable UWB. Connected docs indicate this is addressed by a Samsung patch in the SMR Jan-2026 Release 1, descri...

CVE-2026-21070

Technical details about CVE-2026-21070 are not publicly available in the provided documents. Monitor for updates and new disclosures.

CVE-2023-21452

CVE-2023-21452 concerns Samsung Mobile Bluetooth prior to SMR Mar-2023 Release 1, due to improper usage of implicit intent that enables an attacker to obtain the MAC address of a connected device. Affected software/hardware: Samsung mobile devices with Bluetooth before SMR Mar-2023 Release 1. Roo...

CVE-2023-30648

CVE-2023-30648 : A stack out-of-bounds write vulnerability exists in the RILD component function IpcRxImeiUpdateImeiNoti, leading to a denial of service. Affected software: RILD prior to SMR Jul-2023 Release 1. Root cause: stack out-of-bounds write in IpcRxImeiUpdateImeiNoti. Impact: system DoS. ...

CVE-2023-30662

CVE-2023-30662 is an information-disclosure vulnerability in Samsung UWB on getChipIds exposed by UwbAospAdapterService. Local attackers with low privileges could access the UWB chipset Identifier. The entry is tied to Samsung Mobile devices; impact is confidentiality loss (HIGH). Samsung’s SMR J...

CVE-2023-42534

CVE-2023-42534 affects Samsung Mobile devices via the ChooserActivity module, where improper input validation allows a local attacker to read arbitrary files with system privileges. The issue is documented as present prior to SMR Nov-2023 Release 1. The vulnerability is addressed by Samsung’s sec...

CVE-2023-42562

CVE-2023-42562 affects Samsung devices via the libFacePreProcessingjni.camera.samsung.so library, where an integer overflow in the function detectionFindFaceSupportMultiInstance can trigger a heap overflow. Technical details indicate versions prior to SMR Dec-2023 Release 1 are affected. Remediat...

CVE-2024-20880

CVE-2024-20880 describes a stack-based buffer overflow in the bootloader before SMR Jun-2024 Release 1, enabling a physical attacker to overwrite memory. Documents consistently identify the issue as affecting the bootloader with a physical attack vector and potential memory overwrite impact, but ...

CVE-2026-21010

CVE-2026-21010 describes an improper input validation issue in Samsung Retail Mode prior to SMR Apr-2026 Release 1. The vulnerability allows a local attacker to trigger privileged functions, with confidentiality, integrity, and availability impact reported as high. Public details point to affecte...

CVE-2026-21060

Samsung Contacts shows an improper input validation vulnerability in the app prior to SMR Aug-2026 Release 1, enabling a physical attacker to access data across multiple user profiles. The issue affects Samsung Contacts on affected devices and has a CVSS 4.0 vector with a base score of 6.7 (Mediu...

CVE-2026-21073

CVE-2026-21073 affects Galaxy Themes prior to the SMR Aug-2026 Release 1. Description: improper input validation could allow a physical attacker to launch arbitrary activity. CVSS v4.0 score is 5.2 (Medium) with Attack Vector: Physical, Attack Complexity: Low, Privileges Required: None, User Inte...

CVE-2023-21496

CVE-2023-21496 affects ActivityManagerService in Android/Samsung devices. Affected: ActivityManagerService versions prior to SMR May-2023 Release 1. Issue: Active Debug Code vulnerability allows an attacker to use a debug function by setting the debug level. Evidence of patching: Samsung/Google s...

CVE-2023-21512

CVE-2023-21512 affects Samsung Knox in the notification framework, where improper Knox ID validation allows local attackers to read work profile notifications without proper access. The issue is associated with Samsung devices prior to SMR Jun-2023 Release 1. Remediation recommended by sources is...

CVE-2023-30642

CVE-2023-30642 affects Samsung Galaxy Themes Service. The vulnerability is described as improper privilege management that allows local attackers to call privilege functions within Galaxy Themes Service prior to SMR Jul-2023 Release 1. Connected sources corroborate this issue and specify the affe...

CVE-2023-30667

CVE-2023-30667 describes an improper access control in the Audio system service on Samsung devices prior to the SMR Jul-2023 Release 1, enabling a local attacker to broadcast with system privileges. Affected component is the Audio system service; root cause is access control weakness allowing ele...

CVE-2023-30689

CVE-2023-30689 affects Samsung Mobile devices, caused by an out-of-bounds write in libsec-ril’s BuildOemEmbmsGetSigStrengthResponse. A local attacker can trigger arbitrary code execution. Samsung fixed this in SMR Aug-2023 Release 1; update devices via the Samsung security bulletin. Exploitation ...

CVE-2023-42532

Summary: CVE-2023-42532 concerns the Samsung FotaAgent. Root cause: improper certificate validation in FotaAgent prior to the SMR Nov-2023 Release1. Impact: remote attacker could intercept network traffic, including firmware information, leading to potential confidentiality exposure. Affected sof...

CVE-2023-42558

CVE-2023-42558 is a Samsung vulnerability describing an out-of-bounds write in the HDCP component within HAL prior to Samsung SMR December 2023 Release 1, allowing attacker code execution. The connected sources consistently identify the affected area as HAL/HDCP and note that remediation is provi...

CVE-2024-20878

CVE-2024-20878 describes a heap out-of-bounds write in parsing grid image within libsavscmn.so, prior to SMR June-2024 Release 1. This local vulnerability allows an attacker with local access to potentially execute arbitrary code. Affected detail in public sources consistently cites the same root...

CVE-2024-34640

This CVE (CVE-2024-34640) affects BGProtectManager in Samsung Mobile devices prior to the SMR Sep-2024 Release 1. The root cause is improper access control that allows local attackers to bypass the restriction of process expiration. Reported impact is limited to LOCAL, with a LOW overall severity...

CVE-2025-21003

CVE-2025-21003 concerns insecure storage of sensitive information in Samsung’s Emergency SOS prior to SMR Jul-2025 Release 1, allowing a local attacker to access sensitive data. Connected sources confirm the issue affects Emergency SOS and indicate the vulnerability arises from insecure storage, ...

CVE-2023-30650

The CVE-2023-30650 issue affects Samsung Mobile devices and is described as an out-of-bounds read/write in callrunTspCmd within the sysinput HAL service. The root cause is an overrun in the HAL call that can enable local attackers to execute arbitrary code. Affected component is the sysinput HAL,...

CVE-2023-30668

The CVE-2023-30668 issue stems from an out-of-bounds write in the BuildOemSecureSimLockResponse function of libsec-ril. This affects libsec-ril prior to SMR Jul-2023 Release 1 and enables a local attacker to execute arbitrary code. Samsung's PT-2023-22864 notes update to SMR Jul-2023 Release 1 or...

CVE-2023-42530

CVE-2023-42530 affects Samsung Mobile SecSettings prior to SMR Nov-2023 Release 1. The vulnerability is an improper access control that allows enabling Wi‑Fi and Wi‑Fi Direct without user interaction. Reported impact includes potential high integrity impact (I:H) and high confidentiality/availabi...

CVE-2024-20874

CVE-2024-20874 affects Samsung SmartManagerCN prior to SMR Jun-2024 Release 1. The vulnerability is an improper access control that enables local attackers to perform privileged activities. The NVD metrics show a • LOCAL • LOW complexity • NONE/LOW privileges required with HIGH confidentiality, i...

CVE-2024-20879

CVE-2024-20879 affects the library component libsavscmn.so prior to Samsung SMR Jun-2024 Release 1. The vulnerability stems from improper input validation in libsavscmn.so, enabling local attackers to write out-of-bounds memory. Impact is indicated as local access with potential integrity/availab...

CVE-2026-21015

CVE-2026-21015 : The issue concerns incorrect default permissions in the FactoryCamera prior to the SMR May-2026 Release 1, enabling a local attacker to access the device’s unique identifier. The CVSS v4.0 metrics indicate a LOCAL attack vector, LOW attack complexity, and LOW privilegesRequired, ...

CVE-2026-21065

CVE-2026-21065 is an out-of-bounds write vulnerability in libcodec2secqcelpdec.so , a Samsung mobile library, affecting versions prior to SMR Aug-2026 Release 1 . A local attacker with low privileges can write data beyond allocated memory boundaries, potentially leading to code execution or denia...

CVE-2023-30643

CVE-2023-30643 concerns Samsung Galaxy Themes Service. A missing authentication vulnerability allows local attackers to delete arbitrary non-preloaded applications. Affected product: Galaxy Themes Service in Samsung mobile devices (prior to SMR Jul-2023 Release 1). Root cause: missing authenticat...

CVE-2023-30652

CVE-2023-30652 affects Samsung mobile devices’ sysinput HAL service (pre-SMR Jul-2023 Release 1). It is an out-of-bounds read/write vulnerability in callrunTspCmdNoRead that enables local attackers to execute arbitrary code. Impact is supported by NVD/Red Hat/NCSC advisories; CVSS v3.1 vectors in...

CVE-2023-30660

The CVE-2023-30660 issue affects Samsung UwbAospAdapterService, with the vulnerable component being getDefaultChipId. It allows local attackers to access the UWB chipset Identifier on devices running versions prior to SMR Jul-2023 Release 1. According to PT-2023-22856, impact is exposure of sensi...

CVE-2023-30669

CVE-2023-30669 affects libsec-ril DoOemFactorySendFactoryTestResult; an out-of-bounds write in this component can allow a local attacker to execute arbitrary code. Affected Samsung devices before SMR Jul-2023 Release 1 are vulnerable. Samsung/Android security updates have been released to address...

CVE-2023-42527

CVE-2023-42527 affects libsec-ril, specifically ProcessWriteFile, with improper input validation prior to Samsung SMR Nov-2023 Release 1. A local attacker could expose sensitive information by exploiting this vulnerability. The issue impacts Samsung mobile devices using libsec-ril and is fixed by...