# Samsung Mobile Devices.

Every CVE that names Samsung Mobile Devices among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first (an older page)

- [Out-of-bounds write in libsavsac.so prior to SMR Jul-2026 Release 1 allows remote attackers to execute arbitrary code.](https://agentprime.io/advisories/CVE-2026-21042.md)
  `CVE-2026-21042` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 8.7 High · Not analysed yet · Published 10 Jul 2026
- [Improper access control in SamsungSEAgentService prior to SMR Jul-2026 Release 1 allows local attackers to access sensitive information.](https://agentprime.io/advisories/CVE-2026-21041.md)
  `CVE-2026-21041` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 6.9 Medium · Not analysed yet · Published 10 Jul 2026
- [Improper access control in IAFDService prior to SMR Jul-2026 Release 1 allows local privileged attackers to use the privileged APIs.](https://agentprime.io/advisories/CVE-2026-21040.md)
  `CVE-2026-21040` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 6.9 Medium · Not analysed yet · Published 10 Jul 2026
- [Improper access control in Settings prior to SMR Jul-2026 Release 1 allows local attackers to configure Theft protection settings.](https://agentprime.io/advisories/CVE-2026-21039.md)
  `CVE-2026-21039` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 6.9 Medium · Not analysed yet · Published 10 Jul 2026
- [Improper authorization in AppBlock prior to SMR Jun-2026 Release 1 allows local attacker to launch arbitrary activity.](https://agentprime.io/advisories/CVE-2026-21031.md)
  `CVE-2026-21031` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 5.2 Medium · Not analysed yet · Published 5 Jun 2026
- [Improper access control in MediaTek Audio HAL prior to SMR Jun-2026 Release 1 allows local attackers to trigger privileged functions.](https://agentprime.io/advisories/CVE-2026-21030.md)
  `CVE-2026-21030` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 6.4 Medium · Not analysed yet · Published 5 Jun 2026
- [Improper export of android application components in Galaxy Editing Service prior to SMR Jun-2026 Release 1 allows local attacker to execute privileged operations.](https://agentprime.io/advisories/CVE-2026-21029.md)
  `CVE-2026-21029` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 6.8 Medium · Not analysed yet · Published 5 Jun 2026
- [Improper access control in AuditLogService prior to SMR Jun-2026 Release 1 allows local attackers to access sensitive information.](https://agentprime.io/advisories/CVE-2026-21028.md)
  `CVE-2026-21028` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 5.1 Medium · Not analysed yet · Published 5 Jun 2026
- [Improper export of android application components in ImsSettings prior to SMR Jun-2026 Release 1 allows local attackers to trigger logging function.](https://agentprime.io/advisories/CVE-2026-21027.md)
  `CVE-2026-21027` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 4.8 Medium · Not analysed yet · Published 5 Jun 2026
- [Improper export of android application components in SpriteWallpaper prior to SMR Jun-2026 Release 1 allows local attackers to access to sensitive information.](https://agentprime.io/advisories/CVE-2026-21026.md)
  `CVE-2026-21026` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 6.4 Medium · Not analysed yet · Published 5 Jun 2026
- [Incorrect privilege assignment in Telephony prior to SMR Jun-2026 Release 1 allows local attackers to access sensitive information.](https://agentprime.io/advisories/CVE-2026-21025.md)
  `CVE-2026-21025` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 6.9 Medium · Not analysed yet · Published 5 Jun 2026
- [Improper handling of insufficient privileges in SecTelephonyProvider prior to SMR Jun-2026 Release 1 allows local attackers to access privileged files.](https://agentprime.io/advisories/CVE-2026-21017.md)
  `CVE-2026-21017` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 4.6 Medium · Not analysed yet · Published 5 Jun 2026
- [Improper handling of insufficient permissions in Routines prior to SMR May-2026 Release 1 allows local attackers to access sensitive information.](https://agentprime.io/advisories/CVE-2026-21022.md)
  `CVE-2026-21022` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 6.9 Medium · Not analysed yet · Published 13 May 2026
- [Improper input validation in Routines prior to SMR May-2026 Release 1 allows physical attackers to launch privileged activity.](https://agentprime.io/advisories/CVE-2026-21021.md)
  `CVE-2026-21021` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 5.1 Medium · Not analysed yet · Published 13 May 2026
- [Improper export of android application components in OmaCP prior to SMR May-2026 Release 1 allows local attackers to trigger privileged functions.](https://agentprime.io/advisories/CVE-2026-21020.md)
  `CVE-2026-21020` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 5.1 Medium · Not analysed yet · Published 13 May 2026
- [Improper input validation in FacAtFunction in Galaxy Watch prior to SMR May-2026 Release 1 allows local attacker to execute arbitrary code with system privilege.](https://agentprime.io/advisories/CVE-2026-21019.md)
  `CVE-2026-21019` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 8.9 High · Not analysed yet · Published 13 May 2026
- [Out-of-bounds write in SveService prior to SMR May-2026 Release 1 allows local privileged attackers to execute arbitrary code.](https://agentprime.io/advisories/CVE-2026-21018.md)
  `CVE-2026-21018` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 6.8 Medium · Not analysed yet · Published 13 May 2026
- [Incorrect privilege assignment in LocationManager prior to SMR May-2026 Release 1 allows local attackers to access sensitive information.](https://agentprime.io/advisories/CVE-2026-21016.md)
  `CVE-2026-21016` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 5.1 Medium · Not analysed yet · Published 13 May 2026
- [Incorrect default permissions in FactoryCamera prior to SMR May-2026 Release 1 allows local attacker to access unique identifier.](https://agentprime.io/advisories/CVE-2026-21015.md)
  `CVE-2026-21015` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 6.8 Medium · Not analysed yet · Published 13 May 2026
- [Insufficient verification of data authenticity in PackageManagerService prior to SMR Mar-2026 Release 1 allows local attackers to modify the installation restriction of specific application.](https://agentprime.io/advisories/CVE-2026-21023.md)
  `CVE-2026-21023` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 6.9 Medium · Not analysed yet · Published 29 Apr 2026
- [Improper input validation in Retail Mode prior to SMR Apr-2026 Release 1 allows local attackers to trigger privileged functions.](https://agentprime.io/advisories/CVE-2026-21010.md)
  `CVE-2026-21010` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 6.6 Medium · Not analysed yet · Published 13 Apr 2026
- [Exposure of sensitive information in S Share prior to SMR Apr-2026 Release 1 allows adjacent attacker to access sensitive information.](https://agentprime.io/advisories/CVE-2026-21008.md)
  `CVE-2026-21008` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 5.1 Medium · Not analysed yet · Published 13 Apr 2026
- [External control of file name in AODManager prior to SMR Apr-2026 Release 1 allows privileged local attacker to create file with system privilege.](https://agentprime.io/advisories/CVE-2026-21012.md)
  `CVE-2026-21012` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 6.8 Medium · Not analysed yet · Published 13 Apr 2026
- [Incorrect privilege assignment in Bluetooth in Maintenance mode prior to SMR Apr-2026 Release 1 allows physical attackers to bypass Extend Unlock.](https://agentprime.io/advisories/CVE-2026-21011.md)
  `CVE-2026-21011` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 5.4 Medium · Not analysed yet · Published 13 Apr 2026
- [Improper check for exceptional conditions in Recents prior to SMR Apr-2026 Release 1 allows physical attacker to bypass App Pinning.](https://agentprime.io/advisories/CVE-2026-21009.md)
  `CVE-2026-21009` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 4.1 Medium · Not analysed yet · Published 13 Apr 2026
- [Improper check for exceptional conditions in Device Care prior to SMR Apr-2026 Release 1 allows physical attackers to bypass Knox Guard.](https://agentprime.io/advisories/CVE-2026-21007.md)
  `CVE-2026-21007` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 4.4 Medium · Not analysed yet · Published 13 Apr 2026
- [Improper access control in Samsung DeX prior to SMR Apr-2026 Release 1 allows physical attackers to access to hidden notification contents.](https://agentprime.io/advisories/CVE-2026-21006.md)
  `CVE-2026-21006` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 4.7 Medium · Not analysed yet · Published 13 Apr 2026
- [Improper input validation in data related to network restrictions prior to SMR Apr-2026 Release 1 allows physical attackers to bypass the restrictions.](https://agentprime.io/advisories/CVE-2026-21003.md)
  `CVE-2026-21003` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 5.2 Medium · Not analysed yet · Published 13 Apr 2026
- [Improper authorization in Settings prior to SMR Mar-2026 Release 1 allows local attacker to disable configuring the background data usage of application.](https://agentprime.io/advisories/CVE-2026-20992.md)
  `CVE-2026-20992` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 4.8 Medium · Not analysed yet · Published 16 Mar 2026
- [Improper privilege management in ThemeManager prior to SMR Mar-2026 Release 1 allows local privileged attackers to reuse trial contents.](https://agentprime.io/advisories/CVE-2026-20991.md)
  `CVE-2026-20991` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 6.7 Medium · Not analysed yet · Published 16 Mar 2026
- [Improper export of android application components in Secure Folder prior to SMR Mar-2026 Release 1 allows local attackers to launch arbitrary activity with Secure Folder privilege.](https://agentprime.io/advisories/CVE-2026-20990.md)
  `CVE-2026-20990` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 8.4 High · Not analysed yet · Published 16 Mar 2026
- [Improper verification of cryptographic signature in Font Settings prior to SMR Mar-2026 Release 1 allows physical attackers to use custom font.](https://agentprime.io/advisories/CVE-2026-20989.md)
  `CVE-2026-20989` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 5.1 Medium · Not analysed yet · Published 16 Mar 2026
- [Improper verification of intent by broadcast receiver in Settings prior to SMR Mar-2026 Release 1 allows local attacker to launch arbitrary activity with Settings privilege.](https://agentprime.io/advisories/CVE-2026-20988.md)
  `CVE-2026-20988` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 6.8 Medium · Not analysed yet · Published 16 Mar 2026
- [Improper export of android application components in Samsung Dialer prior to SMR Feb-2026 Release 1 allows local attackers to launch arbitrary activity with Samsung Dialer privilege.](https://agentprime.io/advisories/CVE-2026-20983.md)
  `CVE-2026-20983` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 8.4 High · Not analysed yet · Published 4 Feb 2026
- [Path traversal in ShortcutService prior to SMR Feb-2026 Release 1 allows privileged local attacker to create file with system privilege.](https://agentprime.io/advisories/CVE-2026-20982.md)
  `CVE-2026-20982` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 6.8 Medium · Not analysed yet · Published 4 Feb 2026
- [Improper input validation in FacAtFunction prior to SMR Feb-2026 Release 1 allows privileged physical attacker to execute arbitrary command with system privilege.](https://agentprime.io/advisories/CVE-2026-20981.md)
  `CVE-2026-20981` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 5.4 Medium · Not analysed yet · Published 4 Feb 2026
- [Improper input validation in PACM prior to SMR Feb-2026 Release 1 allows physical attacker to execute arbitrary commands.](https://agentprime.io/advisories/CVE-2026-20980.md)
  `CVE-2026-20980` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 7.0 High · Not analysed yet · Published 4 Feb 2026
- [Improper privilege management in Settings prior to SMR Feb-2026 Release 1 allows local attackers to launch arbitrary activity with Settings privilege.](https://agentprime.io/advisories/CVE-2026-20979.md)
  `CVE-2026-20979` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 8.4 High · Not analysed yet · Published 4 Feb 2026
- [Improper authorization in KnoxGuardManager prior to SMR Feb-2026 Release 1 allows local attackers to bypass the persistence configuration of the application.](https://agentprime.io/advisories/CVE-2026-20978.md)
  `CVE-2026-20978` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 5.8 Medium · Not analysed yet · Published 4 Feb 2026
- [Improper access control in Emergency Sharing prior to SMR Feb-2026 Release 1 allows local attackers to interrupt its functioning.](https://agentprime.io/advisories/CVE-2026-20977.md)
  `CVE-2026-20977` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 6.9 Medium · Not analysed yet · Published 4 Feb 2026
- [Improper input validation in data related to network restrictions prior to SMR Jan-2026 Release 1 allows physical attackers to bypass Carrier Relock.](https://agentprime.io/advisories/CVE-2026-20974.md)
  `CVE-2026-20974` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 5.2 Medium · Not analysed yet · Published 9 Jan 2026
- [Out-of-bounds read in libimagecodec.quram.so prior to SMR Jan-2026 Release 1 allows remote attacker to access out-of-bounds memory.](https://agentprime.io/advisories/CVE-2026-20973.md)
  `CVE-2026-20973` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 5.3 Medium · Not analysed yet · Published 9 Jan 2026
- [Improper Export of Android Application Components in UwbTest prior to SMR Jan-2026 Release 1 allows local attackers to enable UWB.](https://agentprime.io/advisories/CVE-2026-20972.md)
  `CVE-2026-20972` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 4.8 Medium · Not analysed yet · Published 9 Jan 2026
- [Use After Free in PROCA driver prior to SMR Jan-2026 Release 1 allows local attackers to potentially execute arbitrary code.](https://agentprime.io/advisories/CVE-2026-20971.md)
  `CVE-2026-20971` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 7.3 High · Not analysed yet · Published 9 Jan 2026
- [Improper access control in SLocation prior to SMR Jan-2026 Release 1 allows local attackers to execute the privileged APIs.](https://agentprime.io/advisories/CVE-2026-20970.md)
  `CVE-2026-20970` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 6.8 Medium · Not analysed yet · Published 9 Jan 2026
- [Improper input validation in SecSettings prior to SMR Jan-2026 Release 1 allows local attacker to access file with system privilege.](https://agentprime.io/advisories/CVE-2026-20969.md)
  `CVE-2026-20969` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 2.3 Low · Not analysed yet · Published 9 Jan 2026
- [Use after free in DualDAR prior to SMR Jan-2026 Release 1 allows local privileged attackers to execute arbitrary code.](https://agentprime.io/advisories/CVE-2026-20968.md)
  `CVE-2026-20968` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 6.7 Medium · Not analysed yet · Published 9 Jan 2026
- [Heap-based buffer overflow in libimagecodec.quram.so prior to SMR Dec-2025 Release 1 allows remote attackers to access out-of-bounds memory.](https://agentprime.io/advisories/CVE-2025-58480.md)
  `CVE-2025-58480` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 4.3 Medium · Not analysed yet · Published 2 Dec 2025
- [Out-of-bounds read in libimagecodec.quram.so prior to SMR Dec-2025 Release 1 allows remote attackers to access out-of-bounds memory.](https://agentprime.io/advisories/CVE-2025-58479.md)
  `CVE-2025-58479` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 4.3 Medium · Not analysed yet · Published 2 Dec 2025
- [Out-of-bounds write in libimagecodec.quram.so prior to SMR Dec-2025 Release 1 allows remote attackers to access out-of-bounds memory.](https://agentprime.io/advisories/CVE-2025-58478.md)
  `CVE-2025-58478` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 4.3 Medium · Not analysed yet · Published 2 Dec 2025
- [Out-of-bounds write in parsing IFD tag in libimagecodec.quram.so prior to SMR Dec-2025 Release 1 allows remote attackers to access out-of-bounds memory.](https://agentprime.io/advisories/CVE-2025-58477.md)
  `CVE-2025-58477` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 4.3 Medium · Not analysed yet · Published 2 Dec 2025
- [Out-of-bounds read vulnerability in bootloader prior to SMR Dec-2025 Release 1 allows physical attackers to access out-of-bounds memory.](https://agentprime.io/advisories/CVE-2025-58476.md)
  `CVE-2025-58476` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 4.2 Medium · Not analysed yet · Published 2 Dec 2025
- [Improper input validation in libsec-ril.so prior to SMR Dec-2025 Release 1 allows local privileged attackers to write out-of-bounds memory.](https://agentprime.io/advisories/CVE-2025-58475.md)
  `CVE-2025-58475` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 5.6 Medium · Not analysed yet · Published 2 Dec 2025
- [Improper export of android application components in Dynamic Lockscreen prior to SMR Dec-2025 Release 1 allows local attackers to access files with Dynamic Lockscreen's privilege.](https://agentprime.io/advisories/CVE-2025-21080.md)
  `CVE-2025-21080` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 6.2 Medium · Not analysed yet · Published 2 Dec 2025
- [Out-of-bounds write in decoding metadata in fingerprint trustlet prior to SMR Dec-2025 Release 1 allows local privileged attackers to write out-of-bounds memory.](https://agentprime.io/advisories/CVE-2025-21072.md)
  `CVE-2025-21072` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 5.7 Medium · Not analysed yet · Published 2 Dec 2025
- [Out-of-bounds write in libimagecodec.quram.so prior to SMR Nov-2025 Release 1 allows remote attackers to access out-of-bounds memory.](https://agentprime.io/advisories/CVE-2025-21075.md)
  `CVE-2025-21075` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 4.3 Medium · Not analysed yet · Published 5 Nov 2025
- [Out-of-bounds read in libimagecodec.quram.so prior to SMR Nov-2025 Release 1 allows remote attackers to access out-of-bounds memory.](https://agentprime.io/advisories/CVE-2025-21074.md)
  `CVE-2025-21074` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 4.3 Medium · Not analysed yet · Published 5 Nov 2025
- [Insecure default configuration in USB connection mode prior to SMR Nov-2025 Release 1 allows privileged physical attackers to access user data.](https://agentprime.io/advisories/CVE-2025-21073.md)
  `CVE-2025-21073` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 6.8 Medium · Not analysed yet · Published 5 Nov 2025
- [Out-of-bounds write in handling opcode in fingerprint trustlet prior to SMR Nov-2025 Release 1 allows local privileged attackers to write out-of-bounds memory.](https://agentprime.io/advisories/CVE-2025-21071.md)
  `CVE-2025-21071` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 5.7 Medium · Not analysed yet · Published 5 Nov 2025
- [Improper input validiation in Contacts prior to SMR Oct-2025 Release 1 allows local attackers to access data across multiple user profiles.](https://agentprime.io/advisories/CVE-2025-21050.md)
  `CVE-2025-21050` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 7.1 High · Not analysed yet · Published 10 Oct 2025

Newest: <https://agentprime.io/advisories/technology/samsung-mobile-devices.md>
Older: <https://agentprime.io/advisories/technology/samsung-mobile-devices.md?cursor=WyIyMDI1LTEwLTEwVDA2OjQxOjMyLjgyMzAwMFoiLCJDVkUtMjAyNS0yMTA1MCJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=samsung-mobile-devices&cursor=WyIyMDI2LTA3LTEwVDA0OjU4OjA1LjIyMjAwMFoiLCJDVkUtMjAyNi0yMTA0MyJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/samsung-mobile-devices/?cursor=WyIyMDI2LTA3LTEwVDA0OjU4OjA1LjIyMjAwMFoiLCJDVkUtMjAyNi0yMTA0MyJd>. Everything for agents: <https://agentprime.io/llms.txt>.