Samsung Mobile Samsung Mobile Devices vulnerabilities

CVEs per yearBy the year they were published

1. 2021112
2. 2022209
3. 2023156
4. 2024151
5. 2025131
6. 2026107

Known exploitedNewest addition to KEV first

• CVE-2025-21042

  Out-of-bounds write in libimagecodec.quram.so prior to SMR Apr-2025 Release 1 allows remote attackers to execute arbitrary code.

  Samsung Mobile · Samsung Mobile Devices

  ExploitedHigh8.8
• CVE-2025-21043

  Out-of-bounds write in libimagecodec.quram.so prior to SMR Sep-2025 Release 1 allows remote attackers to execute arbitrary code.

  Samsung Mobile · Samsung Mobile Devices

  ExploitedHigh8.8
• CVE-2022-22265

  An improper check or handling of exceptional conditions in NPU driver prior to SMR Jan-2022 Release 1 allows arbitrary memory write and code execution.

  Samsung Mobile · Samsung Mobile Devices

  ExploitedMedium5.0
• CVE-2021-25489

  Assuming radio permission is gained, missing input validation in modem interface driver prior to SMR Oct-2021 Release 1 results in format string bug leading to…

  Samsung Mobile · Samsung Mobile Devices

  ExploitedLow3.3
• CVE-2021-25487

  Lack of boundary checking of a buffer in set_skb_priv() of modem interface driver prior to SMR Oct-2021 Release 1 allows OOB read and it results in arbitrary…

  Samsung Mobile · Samsung Mobile Devices

  ExploitedHigh7.3
• CVE-2021-25394

  A use after free vulnerability via race condition in MFC charger driver prior to SMR MAY-2021 Release 1 allows arbitrary write given a radio privilege is…

  Samsung Mobile · Samsung Mobile Devices

  ExploitedMedium6.4
• CVE-2021-25395

  A race condition in MFC charger driver prior to SMR MAY-2021 Release 1 allows local attackers to bypass signature check given a radio privilege is compromised.

  Samsung Mobile · Samsung Mobile Devices

  ExploitedMedium6.4
• CVE-2021-25372

  An improper boundary check in DSP driver prior to SMR Mar-2021 Release 1 allows out of bounds memory access.

  Samsung Mobile · Samsung Mobile Devices

  ExploitedMedium6.1
• CVE-2021-25371

  A vulnerability in DSP driver prior to SMR Mar-2021 Release 1 allows attackers load arbitrary ELF libraries inside DSP.

  Samsung Mobile · Samsung Mobile Devices

  ExploitedMedium6.1
• CVE-2023-21492

  Kernel pointers are printed in the log file prior to SMR May-2023 Release 1 allows a privileged local attacker to bypass ASLR.

  Samsung Mobile · Samsung Mobile Devices

  ExploitedMedium4.4

Newest CVEs

• CVE-2026-21126

  Improper input validation in getting cover image in libsimba.heifdec.media.samsung.so prior to SMR Oct-2026 Release 1 allows local attackers to write…

  Samsung Mobile · Samsung Mobile Devices

  Medium6.9
• CVE-2026-21125

  Improper input validation in parsing sheifd in libsimba.heifdec.media.samsung.so prior to SMR Oct-2026 Release 1 allows local attackers to potentially execute…

  Samsung Mobile · Samsung Mobile Devices

  High8.6
• CVE-2026-21124

  Improper input validation in getting cover image in libsimba.heifdec.media.samsung.so prior to SMR Oct-2026 Release 1 allows local attackers to potentially…

  Samsung Mobile · Samsung Mobile Devices

  High8.6
• CVE-2026-21123

  Improper privilege management in Locksettings prior to SMR Oct-2026 Release 1 allows local privileged attackers with root privilege to access data of the tied…

  Samsung Mobile · Samsung Mobile Devices

  Medium6.7
• CVE-2026-21122

  Out-of-bounds write in libsamsungtts.so prior to SMR Oct-2026 Release 1 allows local attackers to execute arbitrary code.

  Samsung Mobile · Samsung Mobile Devices

  High7.0
• CVE-2026-21121

  Improper handling of insufficient permission in CmcCore prior to SMR Oct-2026 Release 1 allows local attackers to use the privileged APIs.

  Samsung Mobile · Samsung Mobile Devices

  Medium6.9
• CVE-2026-21120

  Use after free in WSM service prior to SMR Oct-2026 Release 1 allows local attackers to potentially execute arbitrary code with system privilege.

  Samsung Mobile · Samsung Mobile Devices

  High8.9
• CVE-2026-21119

  Out-of-bounds read and write in lib_sag_ai_sound_sep_v2.00.so prior to SMR Oct-2026 Release 1 allows local attackers to read and write out-of-bounds memory.

  Samsung Mobile · Samsung Mobile Devices

  Medium4.8
• CVE-2026-21118

  Improper access control in DownloadProvider prior to SMR Oct-2026 Release 1 allows local attackers to access files in scoped storage.

  Samsung Mobile · Samsung Mobile Devices

  Medium6.9
• CVE-2026-21117

  Improper access control in CocktailBarService prior to SMR Oct-2026 Release 1 allows local attackers to access sensitive information.

  Samsung Mobile · Samsung Mobile Devices

  Medium5.1