Samsung Android vulnerabilities

CVE-2023-21446 [MEDIUM] CWE-20 CVE-2023-21446: Improper input validation in MyFiles prior to version 12.2.09 in Android R(11), 13.1.03.501 in Andro Improper input validation in MyFiles prior to version 12.2.09 in Android R(11), 13.1.03.501 in Android S( 12) and 14.1.00.422 in Android T(13) allows local attacker to access data of MyFiles.

CVE-2023-21426 [MEDIUM] CWE-798 CVE-2023-21426: Hardcoded AES key to encrypt cardemulation PINs in NFC prior to SMR Jan-2023 Release 1 allows attack Hardcoded AES key to encrypt cardemulation PINs in NFC prior to SMR Jan-2023 Release 1 allows attackers to access cardemulation PIN.

CVE-2023-21442 [MEDIUM] CWE-284 CVE-2023-21442: Improper access control vulnerability in Runestone application prior to version 2.9.09.003 in Androi Improper access control vulnerability in Runestone application prior to version 2.9.09.003 in Android R(11) and 3.2.01.007 in Android S(12) allows local attackers to get device location information.

CVE-2023-21423 [MEDIUM] CWE-285 CVE-2023-21423: Improper authorization vulnerability in ChnFileShareKit prior to SMR Jan-2023 Release 1 allows attac Improper authorization vulnerability in ChnFileShareKit prior to SMR Jan-2023 Release 1 allows attacker to control BLE advertising without permission using unprotected action.

CVE-2024-20806 [MEDIUM] CVE-2024-20806: Improper access control in Notification service prior to SMR Jan-2024 Release 1 allows local attacke Improper access control in Notification service prior to SMR Jan-2024 Release 1 allows local attacker to access notification data.

CVE-2025-20934 [MEDIUM] CWE-926 CVE-2025-20934: Improper access control in Sticker Center prior to SMR Apr-2025 Release 1 allows local attackers to Improper access control in Sticker Center prior to SMR Apr-2025 Release 1 allows local attackers to access image files with system privilege.

CVE-2025-20938 [MEDIUM] CVE-2025-20938: Improper access control in SamsungContacts prior to SMR Apr-2025 Release 1 allows local attackers to Improper access control in SamsungContacts prior to SMR Apr-2025 Release 1 allows local attackers to access protected data in SamsungContacts.

CVE-2024-34610 [MEDIUM] CVE-2024-34610: Improper access control in ExtControlDeviceService prior to SMR Aug-2024 Release 1 allows local atta Improper access control in ExtControlDeviceService prior to SMR Aug-2024 Release 1 allows local attackers to access protected data.

CVE-2024-34654 [MEDIUM] CVE-2024-34654: Improper Export of android application component in My Files prior to SMR Sep-2024 Release 1 allows Improper Export of android application component in My Files prior to SMR Sep-2024 Release 1 allows local attackers to access files with My Files' privilege.

CVE-2025-21050 [MEDIUM] CVE-2025-21050: Improper input validiation in Contacts prior to SMR Oct-2025 Release 1 allows local attackers to acc Improper input validiation in Contacts prior to SMR Oct-2025 Release 1 allows local attackers to access data across multiple user profiles.

CVE-2025-20961 [MEDIUM] CVE-2025-20961: Improper handling of insufficient permission or privileges in sepunion service prior to SMR May-2025 Improper handling of insufficient permission or privileges in sepunion service prior to SMR May-2025 Release 1 allows local privileged attackers to access files with system privilege.

CVE-2025-21005 [MEDIUM] CVE-2025-21005: Improper access control in isemtelephony prior to Android 15 allows local attackers to access sensit Improper access control in isemtelephony prior to Android 15 allows local attackers to access sensitive information.

CVE-2025-21054 [MEDIUM] CWE-125 CVE-2025-21054: Out-of-bounds read in the parsing header for JPEG decoding in libpadm.so prior to SMR Oct-2025 Relea Out-of-bounds read in the parsing header for JPEG decoding in libpadm.so prior to SMR Oct-2025 Release 1 allows local attackers to potentially access out-of-bounds memory.

CVE-2025-21033 [MEDIUM] CVE-2025-21033: Improper access control in ContactProvider prior to SMR Sep-2025 Release 1 allows local attackers to Improper access control in ContactProvider prior to SMR Sep-2025 Release 1 allows local attackers to access sensitive information.

CVE-2026-21023 [MEDIUM] CVE-2026-21023: Insufficient verification of data authenticity in PackageManagerService prior to SMR Mar-2026 Releas Insufficient verification of data authenticity in PackageManagerService prior to SMR Mar-2026 Release 1 allows local attackers to modify the installation restriction of specific application.

CVE-2023-21441 [MEDIUM] CWE-345 CVE-2023-21441: Insufficient Verification of Data Authenticity vulnerability in Routine prior to versions 2.6.30.6 i Insufficient Verification of Data Authenticity vulnerability in Routine prior to versions 2.6.30.6 in Android Q(10), 3.1.21.10 in Android R(11) and 3.5.2.23 in Android S(12) allows local attacker to access protected files via unused code.

CVE-2026-21017 [MEDIUM] CVE-2026-21017: Improper handling of insufficient privileges in SecTelephonyProvider prior to SMR Jun-2026 Release 1 Improper handling of insufficient privileges in SecTelephonyProvider prior to SMR Jun-2026 Release 1 allows local attackers to access privileged files.

CVE-2026-21028 [MEDIUM] CVE-2026-21028: Improper access control in AuditLogService prior to SMR Jun-2026 Release 1 allows local attackers to Improper access control in AuditLogService prior to SMR Jun-2026 Release 1 allows local attackers to access sensitive information.

CVE-2026-20988 [MEDIUM] CVE-2026-20988: Improper verification of intent by broadcast receiver in Settings prior to SMR Mar-2026 Release 1 al Improper verification of intent by broadcast receiver in Settings prior to SMR Mar-2026 Release 1 allows local attacker to launch arbitrary activity with Settings privilege. User interaction is required for triggering this vulnerability.

CVE-2024-20864 [MEDIUM] CVE-2024-20864: Improper access control vulnerability in DarManagerService prior to SMR May-2024 Release 1 allows lo Improper access control vulnerability in DarManagerService prior to SMR May-2024 Release 1 allows local attackers to monitor system resources.