Samsung vulnerabilities
Published CVEs affecting Samsung products: 293 record(s), with severity, exploitation and fixes.
Android 114Exynos 1380 Firmware 49Exynos 1480 Firmware 45Exynos 1330 Firmware 43Exynos 1280 Firmware 43Exynos 1580 Firmware 42Exynos 850 Firmware 36Exynos 980 Firmware 32Exynos W930 Firmware 31Exynos W920 Firmware 31Exynos 2400 Firmware 31Exynos 1080 Firmware 29Exynos W1000 Firmware 28Exynos 2200 Firmware 26Exynos 2500 Firmware 21Escargot 18Exynos 990 Firmware 17Smart Switch 16Exynos 2100 Firmware 15Exynos 9110 Firmware 14One 9Exynos Modem 5123 Firmware 9Exynos Modem 5300 Firmware 8Exynos Modem 5400 Firmware 8Notes 7Modem 5123 Firmware 7Rlottie 6Modem 5400 Firmware 6Magicinfo 9 Server 5Galaxy Store 5Account 4Health 4Members 4Assistant 3Modem 5300 Firmware 3Internet 2Motionphoto 2Walrus 2Exynos 9820 Firmware 1Exynos 8890 firmware 1
CVE-2025-52517
Medium · 5.9
CWE-362 Jan 5, 2026
Race Condition in Samsung Exynos 2500 Firmware
An issue was discovered in the Camera in Samsung Mobile Processor and Wearable Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500. A race condition in the issimian device driver results in a double free, leading to a denial of service.
CVE-2025-52516
Medium · 6.2
CWE-822 Jan 5, 2026
Untrusted Pointer Dereference in Samsung Exynos 1330 Firmware
An issue was discovered in the Camera in Samsung Mobile Processor and Wearable Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500. An invalid kernel address dereference in the issimian device driver leads to a denial of service.
CVE-2025-52515
Medium · 5.1
CWE-362 Jan 5, 2026
Race Condition in Samsung Exynos 1330 Firmware
An issue was discovered in the Camera in Samsung Mobile Processor and Wearable Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500. A race condition in the issimian device driver results in an out-of-bounds access, leading to a denial of service.
CVE-2025-49495
High · 8.4
CWE-120 Jan 5, 2026
Classic Buffer Overflow in Samsung Exynos 1380 Firmware
An issue was discovered in the WiFi driver in Samsung Mobile Processor Exynos 1380, 1480, 2400, 1580. Mishandling of an NL80211 vendor command leads to a buffer overflow.
CVE-2025-43706
High · 7.5
CWE-400 Jan 5, 2026
Uncontrolled Resource Consumption in Samsung Exynos 1080 Firmware
An issue was discovered in L2 in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2400, 1580, 9110, W920, W930, Modem 5123, and Modem 5400. Incorrect handling of RRC packets leads to a Denial of Service.
CVE-2025-27807
Critical · 9.1
CWE-787 Jan 5, 2026
Out-of-bounds Write in Samsung Exynos 990 Firmware
An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 9110, W920, W930, W1000, Modem 5123, Modem 5300, Modem 5400. The lack of a length check leads to out-of-bounds writes via malformed NAS packets.
CVE-2025-57836
High · 7.8
CWE-427 Jan 5, 2026
Uncontrolled Search Path Element in Samsung Magician
An issue was discovered in Samsung Magician 6.3.0 through 8.3.2 on Windows. The installer creates a temporary folder with weak permissions during installation, allowing a non-admin user to perform DLL hijacking and escalate privileges.
CVE-2025-52519
High · 7.1
CWE-20 Jan 5, 2026
Improper Input Validation in Samsung Exynos 1330 Firmware
An issue was discovered in the Camera in Samsung Mobile Processor and Wearable Processor Exynos 1330, 1380, 1480, 2400, 1580, and 2500. Improper validation of user-space input in the issimian device driver leads to information disclosure and a denial of service.
CVE-2025-54326
High · 7.5
CWE-476 Dec 3, 2025
NULL Pointer Dereference in Samsung Exynos 1280 Firmware
An issue was discovered in Camera in Samsung Mobile Processor Exynos 1280 and 2200. Unnecessary registration of a hardware IP address in the Camera device driver can lead to a NULL pointer dereference, resulting in a denial of service.
CVE-2025-53965
Medium · 5.3
CWE-119 Dec 3, 2025
Buffer Errors (Improper Restriction of Operations within Memory Bounds) in Samsung Exynos 1280 Firmware
An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 2500, W920, W930, W1000, Modem 5123, Modem 5300, and Modem 5400. The function used to decode the SOR transparent container lacks bounds checking, which can cause a fatal error.
CVE-2025-58488
Medium · 6.5
Dec 1, 2025
Improper verification of source of a communication channel in SmartTouchCall prior to…
Improper verification of source of a communication channel in SmartTouchCall prior to version 1.0.1.1 allows remote attackers to access sensitive information. User interaction is required for triggering this vulnerability.
CVE-2025-58487
Low · 3.3
Dec 1, 2025
Improper authorization in Samsung Account prior to version 15.5.01.1 allows local…
Improper authorization in Samsung Account prior to version 15.5.01.1 allows local attacker to launch arbitrary activity with Samsung Account privilege.
CVE-2025-58486
Medium · 5.5
Dec 1, 2025
Improper input validation in Samsung Account prior to version 15.5.01.1 allows local…
Improper input validation in Samsung Account prior to version 15.5.01.1 allows local attacker to execute arbitrary script.
CVE-2025-58485
Medium · 5.5
Dec 1, 2025
Improper input validation in Samsung Internet prior to version 29.0.0.48 allows local…
Improper input validation in Samsung Internet prior to version 29.0.0.48 allows local attackers to inject arbitrary script.
CVE-2025-58483
Low · 3.3
Dec 1, 2025
Improper export of android application components in Galaxy Store for Galaxy Watch prior…
Improper export of android application components in Galaxy Store for Galaxy Watch prior to version 1.0.06.29 allows local attacker to install arbitrary application on Galaxy Store.
CVE-2025-58482
High · 7.3
Dec 1, 2025
Improper access control in MPLocalService of MotionPhoto prior to version 4.1.51 allows…
Improper access control in MPLocalService of MotionPhoto prior to version 4.1.51 allows local attackers to start privileged service.
CVE-2025-58481
High · 7.8
Dec 1, 2025
Improper access control in MPRemoteService of MotionPhoto prior to version 4.1.51 allows…
Improper access control in MPRemoteService of MotionPhoto prior to version 4.1.51 allows local attackers to start privileged service.
CVE-2025-58480
High · 7.5
CWE-787 Dec 1, 2025
Out-of-bounds Write in Samsung Android
Heap-based buffer overflow in libimagecodec.quram.so prior to SMR Dec-2025 Release 1 allows remote attackers to access out-of-bounds memory.
CVE-2025-58479
High · 7.5
CWE-125 Dec 1, 2025
Out-of-bounds Read in Samsung Android
Out-of-bounds read in libimagecodec.quram.so prior to SMR Dec-2025 Release 1 allows remote attackers to access out-of-bounds memory.
CVE-2025-58478
High · 7.5
CWE-787 Dec 1, 2025
Out-of-bounds Write in Samsung Android
Out-of-bounds write in libimagecodec.quram.so prior to SMR Dec-2025 Release 1 allows remote attackers to access out-of-bounds memory.
CVE-2025-58477
Medium · 6.5
CWE-787 Dec 1, 2025
Out-of-bounds Write in Samsung Android
Out-of-bounds write in parsing IFD tag in libimagecodec.quram.so prior to SMR Dec-2025 Release 1 allows remote attackers to access out-of-bounds memory.
CVE-2025-58476
Medium · 4.6
CWE-125 Dec 1, 2025
Out-of-bounds Read in Samsung Android
Out-of-bounds read vulnerability in bootloader prior to SMR Dec-2025 Release 1 allows physical attackers to access out-of-bounds memory.
CVE-2025-58475
Medium · 4.4
Dec 1, 2025
Improper input validation in libsec-ril.so prior to SMR Dec-2025 Release 1 allows local…
Improper input validation in libsec-ril.so prior to SMR Dec-2025 Release 1 allows local privileged attackers to write out-of-bounds memory.
CVE-2025-21080
High · 7.1
Dec 1, 2025
Improper export of android application components in Dynamic Lockscreen prior to SMR…
Improper export of android application components in Dynamic Lockscreen prior to SMR Dec-2025 Release 1 allows local attackers to access files with Dynamic Lockscreen's privilege.
CVE-2025-21072
Medium · 4.4
CWE-787 Dec 1, 2025
Out-of-bounds Write in Samsung Android
Out-of-bounds write in decoding metadata in fingerprint trustlet prior to SMR Dec-2025 Release 1 allows local privileged attackers to write out-of-bounds memory.