Samsung Android vulnerabilities

CVE-2024-49401 [HIGH] CVE-2024-49401: Improper input validation in Settings Suggestions prior to SMR Nov-2024 Release 1 allows local attac Improper input validation in Settings Suggestions prior to SMR Nov-2024 Release 1 allows local attackers to launch privileged activities.

CVE-2024-34679 [HIGH] CWE-276 CVE-2024-34679: Incorrect default permissions in Crane prior to SMR Nov-2024 Release 1 allows local attackers to acc Incorrect default permissions in Crane prior to SMR Nov-2024 Release 1 allows local attackers to access files with phone privilege.

CVE-2023-42561 [MEDIUM] CWE-787 CVE-2023-42561: Heap out-of-bounds write vulnerability in bootloader prior to SMR Dec-2023 Release 1 allows a physic Heap out-of-bounds write vulnerability in bootloader prior to SMR Dec-2023 Release 1 allows a physical attacker to execute arbitrary code.

CVE-2026-21003 [MEDIUM] CVE-2026-21003: Improper input validation in data related to network restrictions prior to SMR Apr-2026 Release 1 al Improper input validation in data related to network restrictions prior to SMR Apr-2026 Release 1 allows physical attackers to bypass the restrictions.

CVE-2026-21007 [MEDIUM] CWE-754 CVE-2026-21007: Improper check for exceptional conditions in Device Care prior to SMR Apr-2026 Release 1 allows phys Improper check for exceptional conditions in Device Care prior to SMR Apr-2026 Release 1 allows physical attackers to bypass Knox Guard.

CVE-2024-20863 [MEDIUM] CWE-787 CVE-2024-20863: Out of bounds write vulnerability in SNAP in HAL prior to SMR May-2024 Release 1 allows local privil Out of bounds write vulnerability in SNAP in HAL prior to SMR May-2024 Release 1 allows local privileged attackers to execute arbitrary code.

CVE-2024-20843 [MEDIUM] CWE-787 CVE-2024-20843: Out-of-bound write vulnerability in command parsing implementation of libIfaaCa prior to SMR Apr-202 Out-of-bound write vulnerability in command parsing implementation of libIfaaCa prior to SMR Apr-2024 Release 1 allows local privileged attackers to execute arbitrary code.

CVE-2026-21085 [MEDIUM] CWE-787 CVE-2026-21085: Out-of-bounds write in Keymaster trustlet prior to SMR Sep-2026 Release 1 allows local privileged at Out-of-bounds write in Keymaster trustlet prior to SMR Sep-2026 Release 1 allows local privileged attackers to write out-of-bounds memory.

CVE-2026-21104 [MEDIUM] CWE-122 CVE-2026-21104: Heap-based buffer overflow in KnoxVault trustlet prior to SMR Sep-2026 Release 1 allows local privil Heap-based buffer overflow in KnoxVault trustlet prior to SMR Sep-2026 Release 1 allows local privileged attackers to execute arbitrary code.

CVE-2024-20866 [MEDIUM] CVE-2024-20866: Authentication bypass vulnerability in Setupwizard prior to SMR May-2024 Release 1 allows physical a Authentication bypass vulnerability in Setupwizard prior to SMR May-2024 Release 1 allows physical attackers to skip activation step.

CVE-2024-20803 [MEDIUM] CWE-287 CVE-2024-20803: Improper authentication vulnerability in Bluetooth pairing process prior to SMR Jan-2024 Release 1 a Improper authentication vulnerability in Bluetooth pairing process prior to SMR Jan-2024 Release 1 allows remote attackers to establish pairing process without user interaction.

CVE-2026-21073 [MEDIUM] CVE-2026-21073: Improper input validation in Galaxy Themes prior to SMR Aug-2026 Release 1 allows physical attackers Improper input validation in Galaxy Themes prior to SMR Aug-2026 Release 1 allows physical attackers to launch arbitrary activity.

CVE-2023-30707 [HIGH] CVE-2023-30707: Improper input validation vulnerability in FileProviderStatusReceiver in Samsung Keyboard prior to S Improper input validation vulnerability in FileProviderStatusReceiver in Samsung Keyboard prior to SMR Sep-2023 Release 1 allows local attackers to delete arbitrary files with Samsung Keyboard privilege.

CVE-2023-30643 [HIGH] CWE-306 CVE-2023-30643: Missing authentication vulnerability in Galaxy Themes Service prior to SMR Jul-2023 Release 1 allows Missing authentication vulnerability in Galaxy Themes Service prior to SMR Jul-2023 Release 1 allows local attackers to delete arbitrary non-preloaded applications.

CVE-2023-21489 [MEDIUM] CWE-787 CVE-2023-21489: Heap out-of-bounds write vulnerability in bootloader prior to SMR May-2023 Release 1 allows a physic Heap out-of-bounds write vulnerability in bootloader prior to SMR May-2023 Release 1 allows a physical attacker to execute arbitrary code.

CVE-2024-20880 [MEDIUM] CWE-787 CVE-2024-20880: Stack-based buffer overflow vulnerability in bootloader prior to SMR Jun-2024 Release 1 allows physi Stack-based buffer overflow vulnerability in bootloader prior to SMR Jun-2024 Release 1 allows physical attackers to overwrite memory.

CVE-2023-42557 [MEDIUM] CWE-787 CVE-2023-42557: Out-of-bound write vulnerability in libIfaaCa prior to SMR Dec-2023 Release 1 allows local system at Out-of-bound write vulnerability in libIfaaCa prior to SMR Dec-2023 Release 1 allows local system attackers to execute arbitrary code.

CVE-2023-42565 [MEDIUM] CVE-2023-42565: Improper input validation vulnerability in Smart Clip prior to SMR Dec-2023 Release 1 allows local a Improper input validation vulnerability in Smart Clip prior to SMR Dec-2023 Release 1 allows local attackers with shell privilege to execute arbitrary code.

CVE-2025-20937 [MEDIUM] CWE-787 CVE-2025-20937: Out-of-bounds write in Keymaster trustlet prior to SMR May-2025 Release 1 allows local privileged at Out-of-bounds write in Keymaster trustlet prior to SMR May-2025 Release 1 allows local privileged attackers to write out-of-bounds memory.

CVE-2024-20881 [MEDIUM] CVE-2024-20881: Improper input validation vulnerability in chnactiv TA prior to SMR Jun-2024 Release 1 allows local Improper input validation vulnerability in chnactiv TA prior to SMR Jun-2024 Release 1 allows local privileged attackers lead to potential arbitrary code execution.