Samsung Mobile

Products

Exploited and recent CVEs

• CVE-2025-21043 High 8.8 Exploited Out-of-bounds write in libimagecodec.quram.so prior to SMR Sep-2025 Release 1 allows remote attackers to execute arbitrary code. 2.2%
• CVE-2025-21042 High 8.8 Exploited Out-of-bounds write in libimagecodec.quram.so prior to SMR Apr-2025 Release 1 allows remote attackers to execute arbitrary code. 35.6%
• CVE-2023-21492 Medium 4.4 Exploited Kernel pointers are printed in the log file prior to SMR May-2023 Release 1 allows a privileged local attacker to bypass ASLR. 2.6%
• CVE-2022-22265 Medium 5.0 Exploited An improper check or handling of exceptional conditions in NPU driver prior to SMR Jan-2022 Release 1 allows arbitrary memory write and code execution. 0.4%
• CVE-2021-25489 Low 3.3 Exploited Assuming radio permission is gained, missing input validation in modem interface driver prior to SMR Oct-2021 Release 1 results in format string bug leading to kernel panic. 0.5%
• CVE-2021-25487 High 7.3 Exploited Lack of boundary checking of a buffer in set_skb_priv() of modem interface driver prior to SMR Oct-2021 Release 1 allows OOB read and it results in arbitrary code execution by dereference of invalid f 0.6%
• CVE-2021-25394 Medium 6.4 Exploited A use after free vulnerability via race condition in MFC charger driver prior to SMR MAY-2021 Release 1 allows arbitrary write given a radio privilege is compromised. 0.4%
• CVE-2021-25395 Medium 6.4 Exploited A race condition in MFC charger driver prior to SMR MAY-2021 Release 1 allows local attackers to bypass signature check given a radio privilege is compromised. 0.4%
• CVE-2021-25372 Medium 6.1 Exploited An improper boundary check in DSP driver prior to SMR Mar-2021 Release 1 allows out of bounds memory access. 0.8%
• CVE-2021-25371 Medium 6.1 Exploited A vulnerability in DSP driver prior to SMR Mar-2021 Release 1 allows attackers load arbitrary ELF libraries inside DSP. 0.8%
• CVE-2021-25370 Medium 6.1 Exploited An incorrect implementation handling file descriptor in dpu driver prior to SMR Mar-2021 Release 1 results in memory corruption leading to kernel panic. 0.9%
• CVE-2021-25369 Medium 6.2 Exploited An improper access control vulnerability in sec_log file prior to SMR MAR-2021 Release 1 exposes sensitive kernel information to userspace. 1.1%
• CVE-2021-25337 Medium 4.4 Exploited Improper access control in clipboard service in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows untrusted applications to read or write certain local files. 2.8%
• CVE-2026-21157 High 8.3 Improper input validation in Bixby prior to version 4.0.85.6 allows privileged local attackers to launch arbitrary activity. 0.1%
• CVE-2026-21139 High 7.3 Improper access control in Samsung Continuity Service for windows prior to version 4.6.1217.0 allows adjacent attackers to manipulate the connected mobile device. 0.1%
• CVE-2026-21138 Medium 6.9 Insufficient verification of data authenticity in Smart Switch prior to version 3.7.73 allows physical attackers to install arbitrary applications. <0.1%
• CVE-2026-21137 Medium 5.1 Path traversal in Smart Switch prior to version 3.7.73 allows physical attackers to access files with Smart Switch privilege. 0.2%
• CVE-2026-21136 Medium 6.8 Improper authorization in Smart Switch prior to version 3.7.73 allows physical attackers to invoke application restore process. 0.1%
• CVE-2026-21135 Medium 5.9 Improper access control in Samsung Internet prior to version 30.0.5.6 allows local attackers to access sensitive information. 0.1%
• CVE-2026-21134 Medium 6.1 Improper authentication in Samsung Flow prior to version 4.9.22.4 allows adjacent attackers to access sensitive information. 0.2%
• CVE-2026-21133 Medium 5.1 Path traversal in Samsung Flow prior to version 4.9.22.1 allows local attackers to access clipboard data. 0.1%
• CVE-2026-21132 Medium 6.0 Improper input validation in Samsung Internet prior to version 30.0.5.24 allows remote attackers to inject arbitrary script. User interaction is required for triggering this vulnerability. 0.3%
• CVE-2026-21131 Low 2.1 Incorrect default permission in Samsung Flow prior to version 4.9.22.4 allows local attackers to launch an arbitrary activity with Samsung Flow privileges on the connected device. 0.1%
• CVE-2026-21130 Medium 5.1 Improper input validation in CreditCardRetrieveActivity of Samsung Checkout prior to version 5.1.03.1 allows local attackers to launch an arbitrary activity with Samsung Checkout privileges. 0.1%
• CVE-2026-21129 Medium 5.1 Improper input validation in GuestCreditCardRegisterActivity of Samsung Checkout prior to version 5.1.03.1 allows local attackers to launch an arbitrary activity with Samsung Checkout privileges. 0.1%
• CVE-2026-21128 Medium 5.1 Improper input validation in CreditCardRegisterActivity of Samsung Checkout prior to version 5.1.03.1 allows local attackers to launch arbitrary activity with Samsung Checkout privileges. 0.1%
• CVE-2026-21127 Medium 6.9 Improper export of android application components in Samsung Account prior to version 15.7.01.1 allows local attackers to access sensitive data. 0.1%
• CVE-2026-21126 Medium 6.9 Improper input validation in getting cover image in libsimba.heifdec.media.samsung.so prior to SMR Oct-2026 Release 1 allows local attackers to write out-of-bounds memory. 0.1%
• CVE-2026-21125 High 8.6 Improper input validation in parsing sheifd in libsimba.heifdec.media.samsung.so prior to SMR Oct-2026 Release 1 allows local attackers to potentially execute arbitrary code. 0.1%
• CVE-2026-21124 High 8.6 Improper input validation in getting cover image in libsimba.heifdec.media.samsung.so prior to SMR Oct-2026 Release 1 allows local attackers to potentially execute arbitrary code. 0.1%