Samsung Android vulnerabilities
502 known vulnerabilities affecting samsung/android.
Total CVEs
502
CISA KEV
12
actively exploited
Public exploits
1
Exploited in wild
12
Severity breakdown
CRITICAL11HIGH181MEDIUM243LOW67
Vulnerabilities
Page 15 of 26
CVE-2023-21477P4MEDIUMCVSS 5.5v11.0v12.0+1 more2025-09-03
CVE-2023-21477 [MEDIUM] CWE-125 CVE-2023-21477: Access of Memory Location After End of Buffer vulnerability in TIGERF trustlet prior to SMR Apr-2023
Access of Memory Location After End of Buffer vulnerability in TIGERF trustlet prior to SMR Apr-2023 Release 1 allows local attackers to access protected data.
nvd
CVE-2025-20889P4MEDIUMCVSS 5.5v12.0v13.0+1 more2025-02-04
CVE-2025-20889 [MEDIUM] CWE-787 CVE-2025-20889: Out-of-bounds read in decoding malformed bitstream for smp4vtd in libsthmbc.so prior to SMR Jan-2025
Out-of-bounds read in decoding malformed bitstream for smp4vtd in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attackers to read arbitrary memory. User interaction is required for triggering this vulnerability.
nvd
CVE-2025-20891P4MEDIUMCVSS 5.5v12.0v13.0+1 more2025-02-04
CVE-2025-20891 [MEDIUM] CWE-125 CVE-2025-20891: Out-of-bounds read in decoding malformed bitstream of video thumbnails in libsthmbc.so prior to SMR
Out-of-bounds read in decoding malformed bitstream of video thumbnails in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attackers to read arbitrary memory. User interaction is required for triggering this vulnerability.
nvd
CVE-2025-20887P4MEDIUMCVSS 5.5v12.0v13.0+1 more2025-02-04
CVE-2025-20887 [MEDIUM] CWE-125 CVE-2025-20887: Out-of-bounds read in accessing table used for svp8t in libsthmbc.so prior to SMR Jan-2025 Release 1
Out-of-bounds read in accessing table used for svp8t in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attackers to read arbitrary memory. User interaction is required for triggering this vulnerability.
nvd
CVE-2024-34647P4MEDIUMCVSS 5.5v12.0v13.0+1 more2024-09-04
CVE-2024-34647 [MEDIUM] CVE-2024-34647: Incorrect use of privileged API in DualDarManagerProxy prior to SMR Sep-2024 Release 1 allows local
Incorrect use of privileged API in DualDarManagerProxy prior to SMR Sep-2024 Release 1 allows local attackers to access privileged APIs related to knox without proper license.
nvd
CVE-2023-30701P4MEDIUMCVSS 5.5v11.0v12.0+1 more2023-08-10
CVE-2023-30701 [MEDIUM] CVE-2023-30701: PendingIntent hijacking in WifiGeofenceManager prior to SMR Aug-2023 Release 1 allows local attacker
PendingIntent hijacking in WifiGeofenceManager prior to SMR Aug-2023 Release 1 allows local attacker to arbitrary file access.
nvd
CVE-2023-21478P4MEDIUMCVSS 5.5v11.0v12.0+1 more2025-09-03
CVE-2023-21478 [MEDIUM] CVE-2023-21478: Improper input validation vulnerability in TIGERF trustlet prior to SMR Apr-2023 Release 1 allows lo
Improper input validation vulnerability in TIGERF trustlet prior to SMR Apr-2023 Release 1 allows local attackers to access protected data.
nvd
CVE-2024-34651P4MEDIUMCVSS 5.5v12.0v13.0+1 more2024-09-04
CVE-2024-34651 [MEDIUM] CWE-863 CVE-2024-34651: Improper authorization in My Files prior to SMR Sep-2024 Release 1 allows local attackers to access
Improper authorization in My Files prior to SMR Sep-2024 Release 1 allows local attackers to access restricted data in My Files.
nvd
CVE-2026-21025P4MEDIUMCVSS 5.5v14.0v14.0-smr-apr-2022-r1+83 more2026-06-05
CVE-2026-21025 [MEDIUM] CVE-2026-21025: Incorrect privilege assignment in Telephony prior to SMR Jun-2026 Release 1 allows local attackers t
Incorrect privilege assignment in Telephony prior to SMR Jun-2026 Release 1 allows local attackers to access sensitive information.
nvd
CVE-2026-21016P4MEDIUMCVSS 5.5v14.0v14.0-smr-apr-2022-r1+80 more2026-05-13
CVE-2026-21016 [MEDIUM] CVE-2026-21016: Incorrect privilege assignment in LocationManager prior to SMR May-2026 Release 1 allows local attac
Incorrect privilege assignment in LocationManager prior to SMR May-2026 Release 1 allows local attackers to access sensitive information.
nvd
CVE-2025-20892P4MEDIUMCVSS 5.9v13.0v14.02025-02-04
CVE-2025-20892 [MEDIUM] CVE-2025-20892: Protection Mechanism Failure in bootloader prior to SMR Jan-2025 Release 1 allows physical attackers
Protection Mechanism Failure in bootloader prior to SMR Jan-2025 Release 1 allows physical attackers to allow to execute fastboot command. User interaction is required for triggering this vulnerability.
nvd
CVE-2023-42564P4MEDIUMCVSS 5.5≥ 12.0, < 14.0v14.02023-12-05
CVE-2023-42564 [MEDIUM] CVE-2023-42564: Improper access control in knoxcustom service prior to SMR Dec-2023 Release 1 allows attacker to sen
Improper access control in knoxcustom service prior to SMR Dec-2023 Release 1 allows attacker to send broadcast with system privilege.
nvd
CVE-2023-21446P4MEDIUMCVSS 5.5v11.0v12.0+1 more2023-02-09
CVE-2023-21446 [MEDIUM] CWE-20 CVE-2023-21446: Improper input validation in MyFiles prior to version 12.2.09 in Android R(11), 13.1.03.501 in Andro
Improper input validation in MyFiles prior to version 12.2.09 in Android R(11), 13.1.03.501 in Android S( 12) and 14.1.00.422 in Android T(13) allows local attacker to access data of MyFiles.
nvd
CVE-2023-21426P4MEDIUMCVSS 5.5v10.02023-02-09
CVE-2023-21426 [MEDIUM] CWE-798 CVE-2023-21426: Hardcoded AES key to encrypt cardemulation PINs in NFC prior to SMR Jan-2023 Release 1 allows attack
Hardcoded AES key to encrypt cardemulation PINs in NFC prior to SMR Jan-2023 Release 1 allows attackers to access cardemulation PIN.
nvd
CVE-2023-21442P4MEDIUMCVSS 5.5v11.0v12.02023-02-09
CVE-2023-21442 [MEDIUM] CWE-284 CVE-2023-21442: Improper access control vulnerability in Runestone application prior to version 2.9.09.003 in Androi
Improper access control vulnerability in Runestone application prior to version 2.9.09.003 in Android R(11) and 3.2.01.007 in Android S(12) allows local attackers to get device location information.
nvd
CVE-2023-21423P4MEDIUMCVSS 5.5v12.0v13.02023-02-09
CVE-2023-21423 [MEDIUM] CWE-285 CVE-2023-21423: Improper authorization vulnerability in ChnFileShareKit prior to SMR Jan-2023 Release 1 allows attac
Improper authorization vulnerability in ChnFileShareKit prior to SMR Jan-2023 Release 1 allows attacker to control BLE advertising without permission using unprotected action.
nvd
CVE-2025-20934P4MEDIUMCVSS 5.5fixed in 14.0v14.02025-04-08
CVE-2025-20934 [MEDIUM] CWE-926 CVE-2025-20934: Improper access control in Sticker Center prior to SMR Apr-2025 Release 1 allows local attackers to
Improper access control in Sticker Center prior to SMR Apr-2025 Release 1 allows local attackers to access image files with system privilege.
nvd
CVE-2025-20938P4MEDIUMCVSS 5.5v14.02025-04-08
CVE-2025-20938 [MEDIUM] CVE-2025-20938: Improper access control in SamsungContacts prior to SMR Apr-2025 Release 1 allows local attackers to
Improper access control in SamsungContacts prior to SMR Apr-2025 Release 1 allows local attackers to access protected data in SamsungContacts.
nvd
CVE-2025-20961P4MEDIUMCVSS 5.5v13.0v14.0+1 more2025-05-07
CVE-2025-20961 [MEDIUM] CVE-2025-20961: Improper handling of insufficient permission or privileges in sepunion service prior to SMR May-2025
Improper handling of insufficient permission or privileges in sepunion service prior to SMR May-2025 Release 1 allows local privileged attackers to access files with system privilege.
nvd
CVE-2024-34610P4MEDIUMCVSS 5.5v12.0v13.0+1 more2024-08-07
CVE-2024-34610 [MEDIUM] CVE-2024-34610: Improper access control in ExtControlDeviceService prior to SMR Aug-2024 Release 1 allows local atta
Improper access control in ExtControlDeviceService prior to SMR Aug-2024 Release 1 allows local attackers to access protected data.
nvd