Samsung Android vulnerabilities

CVE-2024-34654 [MEDIUM] CVE-2024-34654: Improper Export of android application component in My Files prior to SMR Sep-2024 Release 1 allows Improper Export of android application component in My Files prior to SMR Sep-2024 Release 1 allows local attackers to access files with My Files' privilege.

CVE-2026-21099 [MEDIUM] CWE-280 CVE-2026-21099: Improper access control in SettingsProvider prior to SMR Sep-2026 Release 1 allows local attackers t Improper access control in SettingsProvider prior to SMR Sep-2026 Release 1 allows local attackers to access sensitive information.

CVE-2025-21050 [MEDIUM] CVE-2025-21050: Improper input validiation in Contacts prior to SMR Oct-2025 Release 1 allows local attackers to acc Improper input validiation in Contacts prior to SMR Oct-2025 Release 1 allows local attackers to access data across multiple user profiles.

CVE-2026-21023 [MEDIUM] CVE-2026-21023: Insufficient verification of data authenticity in PackageManagerService prior to SMR Mar-2026 Releas Insufficient verification of data authenticity in PackageManagerService prior to SMR Mar-2026 Release 1 allows local attackers to modify the installation restriction of specific application.

CVE-2023-21441 [MEDIUM] CWE-345 CVE-2023-21441: Insufficient Verification of Data Authenticity vulnerability in Routine prior to versions 2.6.30.6 i Insufficient Verification of Data Authenticity vulnerability in Routine prior to versions 2.6.30.6 in Android Q(10), 3.1.21.10 in Android R(11) and 3.5.2.23 in Android S(12) allows local attacker to access protected files via unused code.

CVE-2026-21017 [MEDIUM] CVE-2026-21017: Improper handling of insufficient privileges in SecTelephonyProvider prior to SMR Jun-2026 Release 1 Improper handling of insufficient privileges in SecTelephonyProvider prior to SMR Jun-2026 Release 1 allows local attackers to access privileged files.

CVE-2026-21028 [MEDIUM] CVE-2026-21028: Improper access control in AuditLogService prior to SMR Jun-2026 Release 1 allows local attackers to Improper access control in AuditLogService prior to SMR Jun-2026 Release 1 allows local attackers to access sensitive information.

CVE-2026-20988 [MEDIUM] CVE-2026-20988: Improper verification of intent by broadcast receiver in Settings prior to SMR Mar-2026 Release 1 al Improper verification of intent by broadcast receiver in Settings prior to SMR Mar-2026 Release 1 allows local attacker to launch arbitrary activity with Settings privilege. User interaction is required for triggering this vulnerability.

CVE-2024-20864 [MEDIUM] CVE-2024-20864: Improper access control vulnerability in DarManagerService prior to SMR May-2024 Release 1 allows lo Improper access control vulnerability in DarManagerService prior to SMR May-2024 Release 1 allows local attackers to monitor system resources.

CVE-2023-21496 [MEDIUM] CWE-489 CVE-2023-21496: Active Debug Code vulnerability in ActivityManagerService prior to SMR May-2023 Release 1 allows att Active Debug Code vulnerability in ActivityManagerService prior to SMR May-2023 Release 1 allows attacker to use debug function via setting debug level.

CVE-2025-20947 [MEDIUM] CVE-2025-20947: Improper handling of insufficient permission or privileges in ClipboardService prior to SMR Apr-2025 Improper handling of insufficient permission or privileges in ClipboardService prior to SMR Apr-2025 Release 1 allows local attackers to access image files across multiple users. User interaction is required for triggering this vulnerability.

CVE-2023-21500 [MEDIUM] CWE-415 CVE-2023-21500: Double free validation vulnerability in setPinPadImages in mPOS TUI trustlet prior to SMR May-2023 R Double free validation vulnerability in setPinPadImages in mPOS TUI trustlet prior to SMR May-2023 Release 1 allows local attackers to access the trustlet memory.

CVE-2023-21453 [MEDIUM] CWE-20 CVE-2023-21453: Improper input validation vulnerability in SoftSim TA prior to SMR Mar-2023 Release 1 allows local a Improper input validation vulnerability in SoftSim TA prior to SMR Mar-2023 Release 1 allows local attackers access to protected data.

CVE-2024-20859 [MEDIUM] CVE-2024-20859: Improper access control vulnerability in FactoryCamera prior to SMR May-2024 Release 1 allows local Improper access control vulnerability in FactoryCamera prior to SMR May-2024 Release 1 allows local attackers to take pictures without privilege.

CVE-2025-20955 [MEDIUM] CVE-2025-20955: Improper Export of Android Application Components in NotificationHistoryImageProvider prior to SMR M Improper Export of Android Application Components in NotificationHistoryImageProvider prior to SMR May-2025 Release 1 allows local attackers to access notification images.

CVE-2024-20858 [MEDIUM] CVE-2024-20858: Improper access control vulnerability in setCocktailHostCallbacks of CocktailBarService prior to SMR Improper access control vulnerability in setCocktailHostCallbacks of CocktailBarService prior to SMR May-2024 Release 1 allows local attackers to access information of current application.

CVE-2024-20857 [MEDIUM] CVE-2024-20857: Improper access control vulnerability in startListening of CocktailBarService prior to SMR May-2024 Improper access control vulnerability in startListening of CocktailBarService prior to SMR May-2024 Release 1 allows local attackers to access information of current application.

CVE-2023-30716 [MEDIUM] CVE-2023-30716: Improper access control vulnerability in SVCAgent prior to SMR Sep-2023 Release 1 allows attackers t Improper access control vulnerability in SVCAgent prior to SMR Sep-2023 Release 1 allows attackers to trigger certain commands.

CVE-2024-34594 [MEDIUM] CVE-2024-34594: Exposure of sensitive information in proc file system prior to SMR Jul-2024 Release 1 allows local a Exposure of sensitive information in proc file system prior to SMR Jul-2024 Release 1 allows local attackers to read kernel memory address.

CVE-2023-21493 [MEDIUM] CWE-284 CVE-2023-21493: Improper access control vulnerability in SemShareFileProvider prior to SMR May-2023 Release 1 allows Improper access control vulnerability in SemShareFileProvider prior to SMR May-2023 Release 1 allows local attackers to access protected data.