Samsung Android vulnerabilities

CVE-2025-58475 [MEDIUM] CVE-2025-58475: Improper input validation in libsec-ril.so prior to SMR Dec-2025 Release 1 allows local privileged a Improper input validation in libsec-ril.so prior to SMR Dec-2025 Release 1 allows local privileged attackers to write out-of-bounds memory.

CVE-2025-21072 [MEDIUM] CWE-787 CVE-2025-21072: Out-of-bounds write in decoding metadata in fingerprint trustlet prior to SMR Dec-2025 Release 1 all Out-of-bounds write in decoding metadata in fingerprint trustlet prior to SMR Dec-2025 Release 1 allows local privileged attackers to write out-of-bounds memory.

CVE-2025-20991 [MEDIUM] CVE-2025-20991: Improper export of Android application components in Bluetooth prior to SMR Jun-2025 Release 1 allow Improper export of Android application components in Bluetooth prior to SMR Jun-2025 Release 1 allows local attackers to make devices discoverable.

CVE-2025-20883 [MEDIUM] CVE-2025-20883: Improper access control in SoundPicker prior to SMR Jan-2025 Release 1 allows physical attackers to Improper access control in SoundPicker prior to SMR Jan-2025 Release 1 allows physical attackers to access data across multiple user profiles.

CVE-2024-49402 [MEDIUM] CVE-2024-49402: Improper input validation in Dressroom prior to SMR Nov-2024 Release 1 allow physical attackers to a Improper input validation in Dressroom prior to SMR Nov-2024 Release 1 allow physical attackers to access data across multiple user profiles.

CVE-2024-34674 [MEDIUM] CVE-2024-34674: Improper access control in Contacts prior to SMR Nov-2024 Release 1 allows physical attackers to acc Improper access control in Contacts prior to SMR Nov-2024 Release 1 allows physical attackers to access data across multiple user profiles.

CVE-2024-34645 [MEDIUM] CVE-2024-34645: Improper input validation in ThemeCenter prior to SMR Sep-2024 Release 1 allows physical attackers t Improper input validation in ThemeCenter prior to SMR Sep-2024 Release 1 allows physical attackers to install privileged applications.

CVE-2024-34675 [MEDIUM] CVE-2024-34675: Improper access control in Dex Mode prior to SMR Nov-2024 Release 1 allows physical attackers to tem Improper access control in Dex Mode prior to SMR Nov-2024 Release 1 allows physical attackers to temporarily access to unlocked screen.

CVE-2026-20991 [MEDIUM] CVE-2026-20991: Improper privilege management in ThemeManager prior to SMR Mar-2026 Release 1 allows local privilege Improper privilege management in ThemeManager prior to SMR Mar-2026 Release 1 allows local privileged attackers to reuse trial contents.

CVE-2024-20894 [MEDIUM] CWE-755 CVE-2024-20894: Improper handling of exceptional conditions in Secure Folder prior to SMR Jul-2024 Release 1 allows Improper handling of exceptional conditions in Secure Folder prior to SMR Jul-2024 Release 1 allows physical attackers to bypass authentication under certain condition. User interaction is required for triggering this vulnerability.

CVE-2023-30714 [MEDIUM] CVE-2023-30714: Improper authorization vulnerability in FolderContainerDragDelegate in One UI Home prior to SMR Sep- Improper authorization vulnerability in FolderContainerDragDelegate in One UI Home prior to SMR Sep-2023 Release 1 allows physical attackers to change some settings of the folder lock.

CVE-2024-34642 [MEDIUM] CWE-863 CVE-2024-34642: Improper authorization in One UI Home prior to SMR Sep-2024 Release 1 allows physical attackers to t Improper authorization in One UI Home prior to SMR Sep-2024 Release 1 allows physical attackers to temporarily access sensitive information.

CVE-2026-21070 [MEDIUM] CWE-20 CVE-2026-21070: Improper input validation in Samsung Message prior to SMR Aug-2026 Release 1 allows physical attacke Improper input validation in Samsung Message prior to SMR Aug-2026 Release 1 allows physical attackers to access sensitive information.

CVE-2025-20884 [MEDIUM] CVE-2025-20884: Improper access control in Samsung Message prior to SMR Jan-2025 Release 1 allows physical attackers Improper access control in Samsung Message prior to SMR Jan-2025 Release 1 allows physical attackers to access data across multiple user profiles.

CVE-2025-58476 [MEDIUM] CWE-125 CVE-2025-58476: Out-of-bounds read vulnerability in bootloader prior to SMR Dec-2025 Release 1 allows physical attac Out-of-bounds read vulnerability in bootloader prior to SMR Dec-2025 Release 1 allows physical attackers to access out-of-bounds memory.

CVE-2025-20953 [MEDIUM] CVE-2025-20953: Improper access control in SmartManagerCN prior to SMR May-2025 Release 1 allows local attackers to Improper access control in SmartManagerCN prior to SMR May-2025 Release 1 allows local attackers to launch activities within SmartManagerCN.

CVE-2024-34592 [MEDIUM] CVE-2024-34592: Improper input validation in parsing RTCP SDES packet in librtp.so prior to SMR Jul-2024 Release 1 a Improper input validation in parsing RTCP SDES packet in librtp.so prior to SMR Jul-2024 Release 1 allows remote attackers to trigger temporary denial of service. User interaction is required for triggering this vulnerability.

CVE-2024-34591 [MEDIUM] CVE-2024-34591: Improper input validation in parsing an item data from RTCP SDES packet in librtp.so prior to SMR Ju Improper input validation in parsing an item data from RTCP SDES packet in librtp.so prior to SMR Jul-2024 Release 1 allows remote attackers to trigger temporary denial of service. User interaction is required for triggering this vulnerability.

CVE-2025-20886 [MEDIUM] CWE-922 CVE-2025-20886: Inclusion of sensitive information in test code in softsim trustlet prior to SMR Jan-2025 Release 1 Inclusion of sensitive information in test code in softsim trustlet prior to SMR Jan-2025 Release 1 allows local privileged attackers to get test key.

CVE-2025-21025 [MEDIUM] CVE-2025-21025: Improper access control in MARsExemptionManager prior to SMR Sep-2025 Release 1 allows local attacke Improper access control in MARsExemptionManager prior to SMR Sep-2025 Release 1 allows local attackers to be excluded from background execution management.