Samsung Android vulnerabilities

CVE-2025-21041 [MEDIUM] CWE-922 CVE-2025-21041: Insecure Storage of Sensitive Information in Secure Folder prior to Android 16 allows local attacker Insecure Storage of Sensitive Information in Secure Folder prior to Android 16 allows local attackers to access sensitive information.

CVE-2024-34616 [MEDIUM] CWE-276 CVE-2024-34616: Improper handling of insufficient permission in KnoxDualDARPolicy prior to SMR Aug-2024 Release 1 al Improper handling of insufficient permission in KnoxDualDARPolicy prior to SMR Aug-2024 Release 1 allows local attackers to access sensitive data.

CVE-2025-21002 [MEDIUM] CVE-2025-21002: Improper access control in LeAudioService prior to SMR Jul-2025 Release 1 allows local attackers to Improper access control in LeAudioService prior to SMR Jul-2025 Release 1 allows local attackers to manipulate broadcasting Auracast.

CVE-2024-34611 [MEDIUM] CVE-2024-34611: Improper access control in KnoxService prior to SMR Aug-2024 Release 1 allows local attackers to get Improper access control in KnoxService prior to SMR Aug-2024 Release 1 allows local attackers to get sensitive information.

CVE-2025-21054 [MEDIUM] CWE-125 CVE-2025-21054: Out-of-bounds read in the parsing header for JPEG decoding in libpadm.so prior to SMR Oct-2025 Relea Out-of-bounds read in the parsing header for JPEG decoding in libpadm.so prior to SMR Oct-2025 Release 1 allows local attackers to potentially access out-of-bounds memory.

CVE-2025-21033 [MEDIUM] CVE-2025-21033: Improper access control in ContactProvider prior to SMR Sep-2025 Release 1 allows local attackers to Improper access control in ContactProvider prior to SMR Sep-2025 Release 1 allows local attackers to access sensitive information.

CVE-2025-21028 [MEDIUM] CVE-2025-21028: Improper privilege management in ThemeManager prior to SMR Sep-2025 Release 1 allows local privilege Improper privilege management in ThemeManager prior to SMR Sep-2025 Release 1 allows local privileged attackers to reuse trial items.

CVE-2026-21026 [MEDIUM] CVE-2026-21026: Improper export of android application components in SpriteWallpaper prior to SMR Jun-2026 Release 1 Improper export of android application components in SpriteWallpaper prior to SMR Jun-2026 Release 1 allows local attackers to access to sensitive information.

CVE-2026-21022 [MEDIUM] CVE-2026-21022: Improper handling of insufficient permissions in Routines prior to SMR May-2026 Release 1 allows loc Improper handling of insufficient permissions in Routines prior to SMR May-2026 Release 1 allows local attackers to access sensitive information.

CVE-2024-34653 [MEDIUM] CWE-22 CVE-2024-34653: Path Traversal in My Files prior to SMR Sep-2024 Release 1 allows physical attackers to access direc Path Traversal in My Files prior to SMR Sep-2024 Release 1 allows physical attackers to access directories with My Files' privilege.

CVE-2024-49411 [MEDIUM] CWE-22 CVE-2024-49411: Path Traversal in ThemeCenter prior to SMR Dec-2024 Release 1 allows physical attackers to copy apk Path Traversal in ThemeCenter prior to SMR Dec-2024 Release 1 allows physical attackers to copy apk files to arbitrary path with ThemeCenter privilege.

CVE-2023-42527 [MEDIUM] CWE-20 CVE-2023-42527: Improper input validation vulnerability in ProcessWriteFile of libsec-ril prior to SMR Nov-2023 Rele Improper input validation vulnerability in ProcessWriteFile of libsec-ril prior to SMR Nov-2023 Release 1 allows local attackers to expose sensitive information.

CVE-2024-20814 [MEDIUM] CWE-125 CVE-2024-20814: Out-of-bounds Read in padmd_vld_ac_prog_refine of libpadm.so prior to SMR Feb-2024 Release 1 allows Out-of-bounds Read in padmd_vld_ac_prog_refine of libpadm.so prior to SMR Feb-2024 Release 1 allows local attackers access unauthorized information.

CVE-2023-30661 [MEDIUM] CVE-2023-30661: Exposure of Sensitive Information vulnerability in getChipInfos in UwbAospAdapterService prior to SM Exposure of Sensitive Information vulnerability in getChipInfos in UwbAospAdapterService prior to SMR Jul-2023 Release 1 allows local attackers to access the UWB chipset Identifier.

CVE-2023-30662 [MEDIUM] CVE-2023-30662: Exposure of Sensitive Information vulnerability in getChipIds in UwbAospAdapterService prior to SMR Exposure of Sensitive Information vulnerability in getChipIds in UwbAospAdapterService prior to SMR Jul-2023 Release 1 allows local attackers to access the UWB chipset Identifier.

CVE-2023-30660 [MEDIUM] CVE-2023-30660: Exposure of Sensitive Information vulnerability in getDefaultChipId in UwbAospAdapterService prior t Exposure of Sensitive Information vulnerability in getDefaultChipId in UwbAospAdapterService prior to SMR Jul-2023 Release 1 allows local attackers to access the UWB chipset Identifier.

CVE-2023-30648 [MEDIUM] CWE-787 CVE-2023-30648: Stack out-of-bounds write vulnerability in IpcRxImeiUpdateImeiNoti of RILD priro to SMR Jul-2023 Rel Stack out-of-bounds write vulnerability in IpcRxImeiUpdateImeiNoti of RILD priro to SMR Jul-2023 Release 1 cause a denial of service on the system.

CVE-2023-30654 [MEDIUM] CVE-2023-30654: Improper access control vulnerability in SLocationService prior to SMR Aug-2023 Release 1 allows loc Improper access control vulnerability in SLocationService prior to SMR Aug-2023 Release 1 allows local attacker to update fake location.

CVE-2023-21449 [MEDIUM] CWE-200 CVE-2023-21449: Improper access control vulnerability in Call application prior to SMR Mar-2023 Release 1 allows loc Improper access control vulnerability in Call application prior to SMR Mar-2023 Release 1 allows local attackers to access sensitive information without proper permission.

CVE-2024-34643 [MEDIUM] CVE-2024-34643: Improper access control in key input related function in Dressroom prior to SMR Sep-2024 Release 1 a Improper access control in key input related function in Dressroom prior to SMR Sep-2024 Release 1 allows local attackers to access protected data. User interaction is required for triggering this vulnerability.