CVE Intelligence

Samsung vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Samsung products: 293 record(s), with severity, exploitation and fixes.

Android 114Exynos 1380 Firmware 49Exynos 1480 Firmware 45Exynos 1330 Firmware 43Exynos 1280 Firmware 43Exynos 1580 Firmware 42Exynos 850 Firmware 36Exynos 980 Firmware 32Exynos W930 Firmware 31Exynos W920 Firmware 31Exynos 2400 Firmware 31Exynos 1080 Firmware 29Exynos W1000 Firmware 28Exynos 2200 Firmware 26Exynos 2500 Firmware 21Escargot 18Exynos 990 Firmware 17Smart Switch 16Exynos 2100 Firmware 15Exynos 9110 Firmware 14One 9Exynos Modem 5123 Firmware 9Exynos Modem 5300 Firmware 8Exynos Modem 5400 Firmware 8Notes 7Modem 5123 Firmware 7Rlottie 6Modem 5400 Firmware 6Magicinfo 9 Server 5Galaxy Store 5Account 4Health 4Members 4Assistant 3Modem 5300 Firmware 3Internet 2Motionphoto 2Walrus 2Exynos 9820 Firmware 1Exynos 8890 firmware 1

Exploited only (KEV) →

CVE-2025-21045 Medium · 5.5 CWE-922 Oct 10, 2025
Insecure Storage of Sensitive Information in Samsung Wear Os
Insecure storage of sensitive information in Galaxy Watch prior to SMR Oct-2025 Release 1 allows local attackers to access sensitive information.
CVE-2025-21044 Medium · 4.4 CWE-787 Oct 10, 2025
Out-of-bounds Write in Samsung Android
Out-of-bounds write in fingerprint trustlet prior to SMR Oct-2025 Release 1 allows local privileged attackers to write out-of-bounds memory.
CVE-2025-21043 Critical · 9.8 KEV High · 57 CWE-787 Sep 12, 2025
Samsung Mobile Devices Out-of-Bounds Write Vulnerability
Out-of-bounds write in libimagecodec.quram.so prior to SMR Sep-2025 Release 1 allows remote attackers to execute arbitrary code.
CVE-2025-21042 Critical · 9.8 KEV High · 66 Public exploit CWE-787 Sep 12, 2025
Samsung Mobile Devices Out-of-Bounds Write Vulnerability
Out-of-bounds write in libimagecodec.quram.so prior to SMR Apr-2025 Release 1 allows remote attackers to execute arbitrary code.
CVE-2025-4632 Critical · 9.8 KEV Urgent · 73 Public exploit CWE-22 May 13, 2025
Samsung MagicINFO 9 Server Path Traversal Vulnerability
Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1052 allows attackers to write arbitrary file as system authority.
CVE-2024-7399 Critical · 9.8 KEV Urgent · 83 Public exploit CWE-22 Aug 12, 2024
Samsung MagicINFO 9 Server Path Traversal Vulnerability
Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1050 allows attackers to write arbitrary file as system authority.
CVE-2023-21492 Medium · 4.4 KEV High · 51 CWE-532 May 4, 2023
Samsung Mobile Devices Insertion of Sensitive Information Into Log File Vulnerability
Kernel pointers are printed in the log file prior to SMR May-2023 Release 1 allows a privileged local attacker to bypass ASLR.
CVE-2021-25489 Medium · 5.5 KEV High · 45 CWE-134 Oct 6, 2021
Samsung Mobile Devices Improper Input Validation Vulnerability
Assuming radio permission is gained, missing input validation in modem interface driver prior to SMR Oct-2021 Release 1 results in format string bug leading to kernel panic.
CVE-2021-25487 High · 7.8 KEV High · 48 CWE-125 Oct 6, 2021
Samsung Mobile Devices Out-of-Bounds Read Vulnerability
Lack of boundary checking of a buffer in set_skb_priv() of modem interface driver prior to SMR Oct-2021 Release 1 allows OOB read and it results in arbitrary code execution by dereference of invalid function pointer.
CVE-2021-25395 Medium · 6.4 KEV CWE-362 Jun 11, 2021
Samsung Mobile Devices Race Condition Vulnerability
A race condition in MFC charger driver prior to SMR MAY-2021 Release 1 allows local attackers to bypass signature check given a radio privilege is compromised.
CVE-2021-25394 Medium · 6.4 KEV CWE-362 Jun 11, 2021
Samsung Mobile Devices Race Condition Vulnerability
A use after free vulnerability via race condition in MFC charger driver prior to SMR MAY-2021 Release 1 allows arbitrary write given a radio privilege is compromised.
CVE-2020-26144 Medium · 6.5 CWE-20 May 11, 2021
Improper Input Validation in Samsung Galaxy I9305 Firmware
An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WEP, WPA, WPA2, and WPA3 implementations accept plaintext A-MSDU frames as long as the first 8 bytes correspond to a valid RFC1042 (i.e., LLC/SNAP) header for EAPOL. An adversary can abuse this to inject arbitrary network packets independent of the network configuration.
CVE-2021-25370 Medium · 4.4 KEV High · 47 CWE-416 Mar 26, 2021
Samsung Mobile Devices Memory Corruption Vulnerability
An incorrect implementation handling file descriptor in dpu driver prior to SMR Mar-2021 Release 1 results in memory corruption leading to kernel panic.
CVE-2021-25369 Medium · 5.5 KEV High · 48 CWE-200 Mar 26, 2021
Samsung Mobile Devices Improper Access Control Vulnerability
An improper access control vulnerability in sec_log file prior to SMR MAR-2021 Release 1 exposes sensitive kernel information to userspace.
CVE-2021-25372 Medium · 6.7 KEV High · 46 CWE-787 Mar 26, 2021
Samsung Mobile Devices Improper Boundary Check Vulnerability
An improper boundary check in DSP driver prior to SMR Mar-2021 Release 1 allows out of bounds memory access.
CVE-2021-25371 Medium · 6.7 KEV High · 46 CWE-912 Mar 26, 2021
Samsung Mobile Devices Unspecified Vulnerability
A vulnerability in DSP driver prior to SMR Mar-2021 Release 1 allows attackers load arbitrary ELF libraries inside DSP.
CVE-2021-25337 High · 7.1 KEV High · 60 Public exploit CWE-269 Mar 4, 2021
Samsung Mobile Devices Improper Access Control Vulnerability
Improper access control in clipboard service in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows untrusted applications to read or write certain local files.
CVE-2016-1010 High · 8.8 KEV High · 56 CWE-190 Mar 12, 2016
Adobe Flash Player and AIR Integer Overflow Vulnerability
Integer overflow in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0963 and CVE-2016-0993.