Samsung Android vulnerabilities

CVE-2024-20836 [MEDIUM] CWE-125 CVE-2024-20836: Out of bounds Read vulnerability in ssmis_get_frm in libsubextractor.so prior to SMR Mar-2024 Releas Out of bounds Read vulnerability in ssmis_get_frm in libsubextractor.so prior to SMR Mar-2024 Release 1 allows local attackers to read out of bounds memory.

CVE-2023-21437 [MEDIUM] CWE-287 CVE-2023-21437: Improper access control vulnerability in Phone application prior to SMR Feb-2023 Release 1 allows lo Improper access control vulnerability in Phone application prior to SMR Feb-2023 Release 1 allows local attackers to access sensitive information via implicit broadcast.

CVE-2023-21425 [MEDIUM] CWE-287 CVE-2023-21425: Improper access control vulnerability in telecom application prior to SMR JAN-2023 Release 1 allows Improper access control vulnerability in telecom application prior to SMR JAN-2023 Release 1 allows local attackers to get sensitive information.

CVE-2023-30713 [MEDIUM] CWE-269 CVE-2023-30713: Improper privilege management vulnerability in FolderLockNotifier in One UI Home prior to SMR Sep-20 Improper privilege management vulnerability in FolderLockNotifier in One UI Home prior to SMR Sep-2023 Release 1 allows local attackers to change some settings of the folder lock.

CVE-2023-30698 [MEDIUM] CVE-2023-30698: Improper access control vulnerability in TelephonyUI prior to SMR Aug-2023 Release 1 allows local at Improper access control vulnerability in TelephonyUI prior to SMR Aug-2023 Release 1 allows local attacker to connect BLE without privilege.

CVE-2023-30642 [MEDIUM] CWE-269 CVE-2023-30642: Improper privilege management vulnerability in Galaxy Themes Service prior to SMR Jul-2023 Release 1 Improper privilege management vulnerability in Galaxy Themes Service prior to SMR Jul-2023 Release 1 allows local attackers to call privilege function.

CVE-2025-21007 [MEDIUM] CWE-787 CVE-2025-21007: Out-of-bounds write in accessing uninitialized memory in libsavsvc.so prior to Android 15 allows loc Out-of-bounds write in accessing uninitialized memory in libsavsvc.so prior to Android 15 allows local attackers to cause memory corruption.

CVE-2024-20897 [MEDIUM] CVE-2024-20897: Use of implicit intent for sensitive communication in FCM function in IMS service prior to SMR Jul-2 Use of implicit intent for sensitive communication in FCM function in IMS service prior to SMR Jul-2024 Release 1 allows local attackers to get sensitive information.

CVE-2024-20899 [MEDIUM] CVE-2024-20899: Use of implicit intent for sensitive communication in RCS function in IMS service prior to SMR Jul-2 Use of implicit intent for sensitive communication in RCS function in IMS service prior to SMR Jul-2024 Release 1 allows local attackers to get sensitive information.

CVE-2024-20898 [MEDIUM] CVE-2024-20898: Use of implicit intent for sensitive communication in SoftphoneClient in IMS service prior to SMR Ju Use of implicit intent for sensitive communication in SoftphoneClient in IMS service prior to SMR Jul-2024 Release 1 allows local attackers to get sensitive information.

CVE-2025-21014 [MEDIUM] CVE-2025-21014: Improper export of android application component in Emergency SoS prior to SMR Aug-2025 Release 1 al Improper export of android application component in Emergency SoS prior to SMR Aug-2025 Release 1 allows local attackers to access sensitive information.

CVE-2026-21064 [MEDIUM] CWE-284 CVE-2026-21064: Improper access control in Weaver prior to SMR Aug-2026 Release 1 allows local attackers to cause de Improper access control in Weaver prior to SMR Aug-2026 Release 1 allows local attackers to cause device inoperability.

CVE-2024-20830 [MEDIUM] CWE-276 CVE-2024-20830: Incorrect default permission in AppLock prior to SMR MAr-2024 Release 1 allows local attackers to co Incorrect default permission in AppLock prior to SMR MAr-2024 Release 1 allows local attackers to configure AppLock settings.

CVE-2023-42559 [MEDIUM] CWE-755 CVE-2023-42559: Improper exception management vulnerability in Knox Guard prior to SMR Dec-2023 Release 1 allows Kno Improper exception management vulnerability in Knox Guard prior to SMR Dec-2023 Release 1 allows Knox Guard lock bypass via changing system time.

CVE-2025-20989 [MEDIUM] CVE-2025-20989: Improper logging in fingerprint trustlet prior to SMR May-2025 Release 1 allows local privileged att Improper logging in fingerprint trustlet prior to SMR May-2025 Release 1 allows local privileged attackers to get a hmac_key.

CVE-2023-42556 [MEDIUM] CVE-2023-42556: Improper usage of implicit intent in Contacts prior to SMR Dec-2023 Release 1 allows attacker to get Improper usage of implicit intent in Contacts prior to SMR Dec-2023 Release 1 allows attacker to get sensitive information.

CVE-2023-21435 [MEDIUM] CWE-200 CVE-2023-21435: Exposure of Sensitive Information vulnerability in Fingerprint TA prior to SMR Feb-2023 Release 1 al Exposure of Sensitive Information vulnerability in Fingerprint TA prior to SMR Feb-2023 Release 1 allows attackers to access the memory address information via log.

CVE-2025-20954 [MEDIUM] CVE-2025-20954: Use of implicit intent for sensitive communication in EnrichedCall prior to SMR May-2025 Release 1 a Use of implicit intent for sensitive communication in EnrichedCall prior to SMR May-2025 Release 1 allows local attackers to access sensitive information. User interaction is required for triggering this vulnerability.

CVE-2023-21440 [MEDIUM] CWE-285 CVE-2023-21440: Improper access control vulnerability in WindowManagerService prior to SMR Feb-2023 Release 1 allows Improper access control vulnerability in WindowManagerService prior to SMR Feb-2023 Release 1 allows attackers to take a screen capture.

CVE-2024-34644 [MEDIUM] CVE-2024-34644: Improper access control in item selection related in Dressroom prior to SMR Sep-2024 Release 1 allow Improper access control in item selection related in Dressroom prior to SMR Sep-2024 Release 1 allows local attackers to access protected data. User interaction is required for triggering this vulnerability.