Advisories · Technology
Samsung Mobile Devices.
Every CVE that names Samsung Mobile Devices among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 4.3 Medium
Out-of-bounds read and write in libimagecodec.quram.so prior to SMR Oct-2025 Release 1 allows remote attackers to access out-of-bounds memory.
- Samsung Mobile Devices
- CVSS 4.0 Medium
Out-of-bounds read in the parsing header for JPEG decoding in libpadm.so prior to SMR Oct-2025 Release 1 allows local attackers to potentially access out-of-bounds memory.
- Samsung Mobile Devices
- CVSS 4.0 Medium
Out-of-bounds write in the parsing header for JPEG decoding in libpadm.so prior to SMR Oct-2025 Release 1 allows local attackers to cause memory corruption.
- Samsung Mobile Devices
- CVSS 4.0 Medium
Out-of-bounds write under specific condition in the pre-processing of JPEG decoding in libpadm.so prior to SMR Oct-2025 Release 1 allows local attackers to cause memory corruption.
- Samsung Mobile Devices
- CVSS 4.0 Medium
Out-of-bounds write in the pre-processing of JPEG decoding in libpadm.so prior to SMR Oct-2025 Release 1 allows local attackers to write out-of-bounds memory.
- Samsung Mobile Devices
- CVSS 5.5 Medium
Improper access control in SecSettings prior to SMR Oct-2025 Release 1 allows local attackers to access sensitive information.
- Samsung Mobile Devices
- CVSS 6.7 Medium
Relative path traversal in Knox Enterprise prior to SMR Oct-2025 Release 1 allows local attackers to execute arbitrary code.
- Samsung Mobile Devices
- CVSS 5.2 Medium
Improper access control in KnoxGuard prior to SMR Oct-2025 Release 1 allows physical attackers to use the privileged APIs.
- Samsung Mobile Devices
- CVSS 2.4 Low
Improper access control in WindowManager in Samsung DeX prior to SMR Oct-2025 Release 1 allows physical attackers to temporarily access to recent app list.
- Samsung Mobile Devices
- CVSS 4.0 Medium
Insecure storage of sensitive information in Galaxy Watch prior to SMR Oct-2025 Release 1 allows local attackers to access sensitive information.
- Samsung Mobile Devices
- CVSS 5.7 Medium
Out-of-bounds write in fingerprint trustlet prior to SMR Oct-2025 Release 1 allows local privileged attackers to write out-of-bounds memory.
- Samsung Mobile Devices
- CVSS 8.8 HighCritical · KEVKEV
Out-of-bounds write in Samsung Mobile Devices
- Samsung Mobile Devices
- Memory corruption
- CVSS 8.8 HighCritical · KEV, CVSS 7+ and EPSSKEV
Out-of-bounds write in Samsung Mobile Devices
- Samsung Mobile Devices
- Memory corruption
- CVSS 4.3 Medium
Improper access control vulnerability in retrieveExternalProxy in MiscPolicy prior to SMR Nov-2022 Release 1 allows local attacker to access to Proxy information.
- Samsung Mobile Devices
- CVSS 4.0 Medium
Out-of-bounds write in libsavsvc.so prior to SMR Sep-2025 Release 1 allows local attackers to potentially execute arbitrary code.
- Samsung Mobile Devices
- CVSS 4.0 Medium
Improper access control in ContactProvider prior to SMR Sep-2025 Release 1 allows local attackers to access sensitive information.
- Samsung Mobile Devices
- CVSS 5.9 Medium
Improper access control in One UI Home prior to SMR Sep-2025 Release 1 allows physical attackers to bypass Kiosk mode under limited conditions.
- Samsung Mobile Devices
- CVSS 6.8 Medium
Improper access control in Samsung Mobile Devices
- Samsung Mobile Devices
- Broken access control
- CVSS 4.3 Medium
Improper handling of insufficient permission in AppPrelaunchManagerService prior to SMR Sep-2025 Release 1 in Chinese Android 15 allows local attackers to execute arbitrary application in the backgro…
- Samsung Mobile Devices
- CVSS 4.0 Medium
Improper handling of insufficient permission in System UI prior to SMR Sep-2025 Release 1 allows local attackers to send arbitrary replies to messages from the cover display.
- Samsung Mobile Devices
- CVSS 5.5 Medium
Improper privilege management in ThemeManager prior to SMR Sep-2025 Release 1 allows local privileged attackers to reuse trial items.
- Samsung Mobile Devices
- CVSS 5.1 Medium
Improper verification of intent by broadcast receiver in ImsService prior to SMR Sep-2025 Release 1 allows local attackers to temporarily disable the SIM.
- Samsung Mobile Devices
- CVSS 4.0 Medium
Improper handling of insufficient permission in ImsService prior to SMR Sep-2025 Release 1 allows local attackers to interrupt the call.
- Samsung Mobile Devices
- CVSS 5.1 Medium
Improper access control in MARsExemptionManager prior to SMR Sep-2025 Release 1 allows local attackers to be excluded from background execution management.
- Samsung Mobile Devices
- CVSS 6.3 Medium
Intent redirection vulnerability in SecSettings prior to SMR Apr-2022 Release 1 allows attackers to access arbitrary file with system privilege.
- Samsung Mobile Devices
- CVSS 8.5 High
Improper input validation vulnerability in CertByte prior to SMR Apr-2023 Release 1 allows local attackers to launch privileged activities.
- Samsung Mobile Devices
- CVSS 5.3 Medium
Improper authorization in Smart suggestions prior to SMR Apr-2023 Release 1 in Android 13 and 4.1.01.0 in Android 12 allows remote attackers to register a schedule.
- Samsung Mobile Devices
- CVSS 6.0 Medium
Improper input validation vulnerability in TIGERF trustlet prior to SMR Apr-2023 Release 1 allows local attackers to access protected data.
- Samsung Mobile Devices
- CVSS 7.9 High
Access of Memory Location After End of Buffer vulnerability in TIGERF trustlet prior to SMR Apr-2023 Release 1 allows local attackers to access protected data.
- Samsung Mobile Devices
- CVSS 8.0 High
Out-of-bounds write in Samsung Mobile Devices
- Samsung Mobile Devices
- Memory corruption
- CVSS 8.0 High
Out-of-bounds write in Samsung Mobile Devices
- Samsung Mobile Devices
- Memory corruption
- CVSS 6.8 Medium
Improper input validation in Samsung Mobile Devices
- Samsung Mobile Devices
- CWE-20
- CVSS 6.8 Medium
Improper input validation in Samsung Mobile Devices
- Samsung Mobile Devices
- CWE-20
- CVSS 4.0 Medium
Improper authentication in Samsung Mobile Devices
- Samsung Mobile Devices
- Authentication bypass
- CVSS 4.0 Medium
Improper access control vulnerability in SLocation prior to SMR Apr-2022 Release 1 allows local attackers to get device location information using com.samsung.android.wifi.NETWORK_LOCATION action.
- Samsung Mobile Devices
- CVSS 4.0 Medium
Improper access control vulnerability in SLocation prior to SMR Apr-2022 Release 1 allows local attackers to get device location information using com.samsung.android.wifi.GEOFENCE action.
- Samsung Mobile Devices
- CVSS 5.9 Medium
Improper access control vulnerability in Telephony prior to SMR Apr-2023 Release 1 allows attackers to access files with escalated permission.
- Samsung Mobile Devices
- CVSS 4.6 Medium
Improper authentication in Samsung Mobile Devices
- Samsung Mobile Devices
- Authentication bypass
- CVSS 5.3 Medium
Improper authentication in Samsung Mobile Devices
- Samsung Mobile Devices
- Authentication bypass
- CVSS 4.3 Medium
Improper access control in PkgPredictorService prior to SMR Aug-2025 Release 1 in Chinese Android 13, 14, 15 and 16 allows local attackers to use the privileged APIs.
- Samsung Mobile Devices
- CVSS 4.0 Medium
Path Traversal in Document scanner prior to SMR Aug-2025 Release 1 allows local attackers to delete file with Document scanner's privilege.
- Samsung Mobile Devices
- CVSS 4.3 Medium
Improper export of android application component in Emergency SoS prior to SMR Aug-2025 Release 1 allows local attackers to access sensitive information.
- Samsung Mobile Devices
- CVSS 6.2 Medium
Improper access control in SemSensorManager for Galaxy Watch prior to SMR Aug-2025 Release 1 allows local attackers to access sensitive information related to outdoor exercise and sleep time.
- Samsung Mobile Devices
- CVSS 5.5 Medium
Improper access control in fall detection for Galaxy Watch prior to SMR Aug-2025 Release 1 allows local attackers to modify fall detection configuration.
- Samsung Mobile Devices
- CVSS 5.5 Medium
Improper access control in SemSensorService for Galaxy Watch prior to SMR Aug-2025 Release 1 allows local attackers to access sensitive information related to motion and body sensors.
- Samsung Mobile Devices
- CVSS 6.0 Medium
Improper privilege management in SamsungAccount prior to SMR Aug-2025 Release 1 allows local privileged attackers to deactivate Samsung account.
- Samsung Mobile Devices
- CVSS 4.0 Medium
Improper access control in accessing system device node prior to SMR Aug-2025 Release 1 allows local attackers to access device identifier.
- Samsung Mobile Devices
- CVSS 6.2 Medium
Improper verification of intent by broadcast receiver in System UI for Galaxy Watch prior to SMR Jul-2025 Release 1 allows local attackers to power off the device.
- Samsung Mobile Devices
- CVSS 4.0 Medium
Insecure storage of sensitive information in Emergency SOS prior to SMR Jul-2025 Release 1 allows local attackers to access sensitive information.
- Samsung Mobile Devices
- CVSS 6.2 Medium
Improper access control in LeAudioService prior to SMR Jul-2025 Release 1 allows local attackers to manipulate broadcasting Auracast.
- Samsung Mobile Devices
- CVSS 6.2 Medium
Improper access control in LeAudioService prior to SMR Jul-2025 Release 1 allows local attackers to stop broadcasting Auracast.
- Samsung Mobile Devices
- CVSS 6.2 Medium
Improper privilege management in Bluetooth prior to SMR Jul-2025 Release 1 allows local attackers to enable Bluetooth.
- Samsung Mobile Devices
- CVSS 4.1 Medium
Improper authorization in accessing saved Wi-Fi password for Galaxy Tablet prior to SMR Jul-2025 Release 1 allows secondary users to access owner's saved Wi-Fi password.
- Samsung Mobile Devices
- CVSS 5.5 Medium
Improper access control in SamsungAccount for Galaxy Watch prior to SMR Jul-2025 Release 1 allows local attackers to access phone number.
- Samsung Mobile Devices
- CVSS 6.2 Medium
Incorrect default permission in Framework for Galaxy Watch prior to SMR Jul-2025 Release 1 allows local attackers to reset some configuration of Galaxy Watch.
- Samsung Mobile Devices
- CVSS 6.4 Medium
Out-of-bounds write in checking auth secret in KnoxVault trustlet prior to SMR Jul-2025 Release 1 allows local privileged attackers to write out-of-bounds memory.
- Samsung Mobile Devices
- CVSS 6.4 Medium
Out-of-bounds write in setting auth secret in KnoxVault trustlet prior to SMR Jul-2025 Release 1 allows local privileged attackers to write out-of-bounds memory.
- Samsung Mobile Devices
- CVSS 4.0 Medium
Out-of-bounds write in libsecimaging.camera.samsung.so prior to SMR Jun-2025 Release 1 allows local attackers to write out-of-bounds memory.
- Samsung Mobile Devices
- CVSS 4.0 Medium
Out-of-bound read in libsecimaging.camera.samsung.so prior to SMR Feb-2025 Release 1 allows local attackers to read out-of-bounds memory.
- Samsung Mobile Devices
- CVSS 4.0 Medium
Improper export of Android application components in Bluetooth prior to SMR Jun-2025 Release 1 allows local attackers to make devices discoverable.
- Samsung Mobile Devices