Samsung

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any Samsung product.

RSS Feeds for Samsung security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in Samsung products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by Samsung Sorted by Most Security Vulnerabilities since 2018

Samsung Android351 vulnerabilities

Samsung Mobile Devices148 vulnerabilities

Samsung Exynos90 vulnerabilities

Samsung Notes62 vulnerabilities

Samsung Galaxy Store31 vulnerabilities

Samsung Internet28 vulnerabilities

Samsung Account24 vulnerabilities

Samsung Magicinfo 9 Server24 vulnerabilities

Samsung Smartthings20 vulnerabilities

Samsung Pass16 vulnerabilities

Samsung Health15 vulnerabilities

Samsung Email14 vulnerabilities

Samsung Blockchain Keystore12 vulnerabilities

Samsung Rlottie11 vulnerabilities

Samsung Flow10 vulnerabilities

Samsung Pass10 vulnerabilities

Samsung Cloud9 vulnerabilities

Samsung Members9 vulnerabilities

Samsung Email9 vulnerabilities

Samsung Exynos 1330 Firmware8 vulnerabilities

Samsung Gallery8 vulnerabilities

Samsung Blockchain Keystore7 vulnerabilities

Samsung Bixby6 vulnerabilities

Samsung Data Management Server Firmware6 vulnerabilities

Samsung Exynos 1280 Firmware6 vulnerabilities

Samsung Wear Os6 vulnerabilities

Samsung Flow6 vulnerabilities

Samsung Checkout5 vulnerabilities

Samsung Exynos 850 Firmware5 vulnerabilities

Samsung Pay4 vulnerabilities

Samsung Magician4 vulnerabilities

Samsung Update3 vulnerabilities

Samsung Exynos 1380 Firmware3 vulnerabilities

Samsung Nearby Device Scanning2 vulnerabilities

Samsung Easysetup2 vulnerabilities

Samsung Escargot2 vulnerabilities

Samsung Exynos 1080 Firmware2 vulnerabilities

Samsung Exynos 1580 Firmware2 vulnerabilities

Samsung Exynos 2200 Firmware2 vulnerabilities

Samsung Exynos Modem 5300 Firmware2 vulnerabilities

Samsung Galaxy S24 Firmware2 vulnerabilities

Samsung Uphelper Library2 vulnerabilities

Samsung Group Sharing2 vulnerabilities

Samsung Assistant1 vulnerability

Samsung Dex1 vulnerability

Samsung Exynos 1480 Firmware1 vulnerability

Samsung Galaxystore1 vulnerability

Recent Samsung Security Advisories

Advisory	Title	Published
SMR-Nov-2026	Samsung Mobile Security Maintenance Release SMR-Nov-2026	November 3, 2026
SMR-Oct-2026	Samsung Mobile Security Maintenance Release SMR-Oct-2026	October 6, 2026
SMR-Sep-2026	Samsung Mobile Security Maintenance Release SMR-Sep-2026	September 8, 2026
SMR-Aug-2026	Samsung Mobile Security Maintenance Release SMR-Aug-2026	August 4, 2026
SMR-Jul-2026	Samsung Mobile Security Maintenance Release SMR-Jul-2026	July 7, 2026
SMR-Jun-2026	Samsung Mobile Security Maintenance Release SMR-Jun-2026	June 2, 2026
SMR-May-2026	Samsung Mobile Security Maintenance Release SMR-May-2026	May 6, 2026
SMR-Apr-2026	Samsung Mobile Security Maintenance Release SMR-Apr-2026	April 7, 2026
SMR-Mar-2026	Samsung Mobile Security Maintenance Release SMR-Mar-2026	March 3, 2026
SMR-Feb-2026	Samsung Mobile Security Maintenance Release SMR-Feb-2026	February 3, 2026

Known Exploited Samsung Vulnerabilities

The following Samsung vulnerabilities have been marked by CISA as Known to be Exploited by threat actors.

Title	Description	Added
Samsung MagicINFO 9 Server Path Traversal Vulnerability	Samsung MagicINFO 9 Server contains a path traversal vulnerability that could allow an attacker to write arbitrary files as system authority. CVE-2024-7399 Exploit Probability: 91.9%	April 24, 2026
Samsung Mobile Devices Out-of-Bounds Write Vulnerability	Samsung mobile devices contain an out-of-bounds write vulnerability in libimagecodec.quram.so. This vulnerability could allow remote attackers to execute arbitrary code. CVE-2025-21042 Exploit Probability: 35.6%	November 10, 2025
Samsung Mobile Devices Out-of-Bounds Write Vulnerability	Samsung mobile devices contain an out-of-bounds write vulnerability in libimagecodec.quram.so which allows remote attackers to execute arbitrary code. CVE-2025-21043 Exploit Probability: 2.2%	October 2, 2025
Samsung MagicINFO 9 Server Path Traversal Vulnerability	Samsung MagicINFO 9 Server contains a path traversal vulnerability that allows an attacker to write arbitrary file as system authority. CVE-2025-4632 Exploit Probability: 24.1%	May 22, 2025
Samsung Mobile Devices Use-After-Free Vulnerability	Samsung devices with selected Exynos chipsets contain a use-after-free vulnerability that allows malicious memory write and code execution. CVE-2022-22265 Exploit Probability: 0.4%	September 18, 2023
Samsung Mobile Devices Out-of-Bounds Read Vulnerability	Samsung mobile devices contain an out-of-bounds read vulnerability within the modem interface driver due to a lack of boundary checking of a buffer in set_skb_priv(), leading to remote code execution by dereference of an invalid function pointer. CVE-2021-25487 Exploit Probability: 0.6%	June 29, 2023
Samsung Mobile Devices Improper Input Validation Vulnerability	Samsung mobile devices contain an improper input validation vulnerability within the modem interface driver that results in a format string bug leading to kernel panic. CVE-2021-25489 Exploit Probability: 0.5%	June 29, 2023
Samsung Mobile Devices Race Condition Vulnerability	Samsung mobile devices contain a race condition vulnerability within the MFC charger driver that leads to a use-after-free allowing for a write given a radio privilege is compromised. CVE-2021-25394 Exploit Probability: 0.4%	June 29, 2023
Samsung Mobile Devices Race Condition Vulnerability	Samsung mobile devices contain a race condition vulnerability within the MFC charger driver that leads to a use-after-free allowing for a write given a radio privilege is compromised. CVE-2021-25395 Exploit Probability: 0.4%	June 29, 2023
Samsung Mobile Devices Unspecified Vulnerability	Samsung mobile devices contain an unspecified vulnerability within DSP driver that allows attackers to load ELF libraries inside DSP. CVE-2021-25371 Exploit Probability: 0.8%	June 29, 2023
Samsung Mobile Devices Improper Boundary Check Vulnerability	Samsung mobile devices contain an improper boundary check vulnerability within DSP driver that allows for out-of-bounds memory access. CVE-2021-25372 Exploit Probability: 0.8%	June 29, 2023
Samsung Mobile Devices Insertion of Sensitive Information Into Log File Vulnerability	Samsung mobile devices running Android 11, 12, and 13 contain an insertion of sensitive information into log file vulnerability that allows a privileged, local attacker to conduct an address space layout randomization (ASLR) bypass. CVE-2023-21492 Exploit Probability: 2.6%	May 19, 2023
Samsung Mobile Devices Improper Access Control Vulnerability	Samsung mobile devices contain an improper access control vulnerability in clipboard service which allows untrusted applications to read or write arbitrary files. This vulnerability was chained with CVE-2021-25369 and CVE-2021-25370. CVE-2021-25337 Exploit Probability: 2.8%	November 8, 2022
Samsung Mobile Devices Improper Access Control Vulnerability	Samsung mobile devices using Mali GPU contains an improper access control vulnerability in sec_log file. Exploitation of the vulnerability exposes sensitive kernel information to the userspace. This vulnerability was chained with CVE-2021-25337 and CVE-2021-25370. CVE-2021-25369 Exploit Probability: 1.1%	November 8, 2022
Samsung Mobile Devices Memory Corruption Vulnerability	Samsung mobile devices using Mali GPU contain an incorrect implementation handling file descriptor in dpu driver. This incorrect implementation results in memory corruption, leading to kernel panic. This vulnerability was chained with CVE-2021-25337 and CVE-2021-25369. CVE-2021-25370 Exploit Probability: 0.9%	November 8, 2022

The vulnerability CVE-2024-7399: Samsung MagicINFO 9 Server Path Traversal Vulnerability is in the top 1% of the currently known exploitable vulnerabilities. 2 known exploited Samsung vulnerabilities are in the top 5% (95th percentile or greater) of the EPSS exploit probability rankings.

By the Year

In 2026 there have been 243 vulnerabilities in Samsung with an average score of 6.5 out of ten. Last year, in 2025 Samsung had 192 security vulnerabilities published. That is, 51 more vulnerabilities have already been reported in 2026 as compared to last year. However, the average CVE base score of the vulnerabilities in 2026 is greater by 0.22.

Year	Vulnerabilities	Average Score
2026	243	6.51
2025	192	6.29
2024	230	5.95
2023	236	6.33
2022	147	5.66
2021	73	5.73
2020	10	8.10
2019	7	7.00
2018	20	7.71

It may take a day or so for new Samsung vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Samsung Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-48173	Nov 05, 2026	Samsung Exynos NAS handler length validation leads to memory corruption In the NAS message handler, improper validation of the length field in NAS message causes memory corruption	Exynos
CVE-2026-48174	Nov 05, 2026	Samsung 5G NR RRC DoS via Pre-Auth Message Handling In the NR RRC component, improper handling of messages before authentication triggers a data abort, which leads to a denialofservice condition.	Exynos
CVE-2026-35494	Nov 05, 2026	CVE-2026-35494: Samsung Baseband NAS Packet Memory Corruption DoS In the baseband, memory corruption during NAS packet processing can cause a denial of service.	Exynos
CVE-2026-48178	Nov 05, 2026	Out-of-bounds PPC race condition in Samsung Exynos SoCs Out of bound access in PPC due to race condition in global variable access	Exynos
CVE-2026-48186	Nov 05, 2026	Improper Message Handling PreAS Security Activation in Samsung Exynos Improper handling of messages before AS security activation can cause unexpected behavior	Exynos
CVE-2026-68993	Nov 05, 2026	Double Free in Samsung Exynos NPU Driver A double free vulnerability in NPU driver due to improper pointer management (940)	Exynos
CVE-2026-68994	Nov 05, 2026	Samsung Exynos NPU Driver Double-Free Vulnerability A double free vulnerability in NPU driver due to improper pointer management (941)	Exynos
CVE-2026-48183	Nov 05, 2026	Improper Permission Handling in Samsung Exynos Buffer Driver Improper permission handling during buffer operations allows untrusted applications to create memory mappings with inappropriate permissions	Exynos
CVE-2026-68984	Nov 05, 2026	CVE-2026-68984: Exynos NPU Kernel Driver Integer Overflow In the Samsung Exynos NPU kernel driver, an integer overflow allows an unprivileged application to trigger memory corruption.	Exynos
CVE-2026-69005	Nov 05, 2026	Int overflow in Samsung NPU driver param processing Integer overflow in NPU driver parameter processing due to insufficient bounds checking.	Exynos
CVE-2026-68985	Nov 05, 2026	Samsung Exynos NPU driver OOB write DoS In the Samsung Exynos NPU driver, improper validation of user input in the ioctl handler can lead to an out-of-bounds write, which causes a denial of service.	Exynos
CVE-2026-69006	Nov 05, 2026	CVE-2026-69006: Samsung GNSS Firmware Loader Length Validation Issue Insufficient validation of length fields in the GNSS firmware loader can result in kernelmemory corruption.	Exynos
CVE-2026-69068	Nov 05, 2026	Exynos Modem GNSS Firmware Loader Insufficient Length Validation Insufficient length validation in the GNSS firmware loader may lead to corruption of kernel memory.	Exynos
CVE-2026-69025	Nov 05, 2026	Exynos NPU driver ioctl OOB write DoS (Samsung) In the Exynos NPU driver, improper validation of user input in the ioctl handler can lead to an out-of-bounds write, which causes a denial of service	Exynos
CVE-2026-68990	Nov 05, 2026	Exynos H-Arx DRM Plugin Buffer Validation Flaw (CVE-2026-68990) In the Samsung Exynos H-Arx DRM plugin, improper input validation during buffer operations can cause memory corruption, potentially leading to denial of service or privilege escalation.	Exynos
CVE-2026-68991	Nov 05, 2026	CVE-2026-68991: Samsung Exynos ENN NN HAL memory corruption DoS In the Samsung Exynos ENN NeuralNetworks HAL, improper input validation during request processing can cause memory corruption and lead to a denial of service condition.	Exynos
CVE-2026-69002	Nov 05, 2026	Exynos SoC missing permission checks cause auth bypass Incorrect authorization in Samsung framework services due to missing permission checks	Exynos
CVE-2026-69066	Nov 05, 2026	Samsung Exynos GPU driver VMID reservation memory corruption Memory corruption in GPU driver due to improper validation of VMID reservation.	Exynos
CVE-2026-69050	Nov 05, 2026	OOB Memory Access in Samsung Semiconductor Device Driver Out-of-bounds memory access in a device driver due to improper resource state tracking.	Exynos
CVE-2026-69043	Nov 05, 2026	Exynos GPU driver Improper Sync Memory Corruption (CVE202669043) In the Samsung Exynos GPU driver, improper synchronization during buffer object creation and closing can lead to memory corruption	Exynos
CVE-2026-69044	Nov 05, 2026	Ref Count OOB Memory Corruption in Samsung Exynos GPU Driver In the Samsung GPU driver, improper reference count handling during command submission can lead to memory corruption.	Exynos
CVE-2025-66366	Nov 05, 2026	Samsung Baseband RRCSetup Crash (CVE-2025-66366) Incorrect handling of unauthenticated downlink RRCSetup messages can cause the baseband to crash	Exynos
CVE-2026-33965	Nov 05, 2026	Info Exposure via IMS/SIP Message Flow in Samsung Exynos Modem 5xxx An attacker may send a malicious IMS message to the target device, potentially leading to information exposure through the SIP message flow.	Exynos
CVE-2025-66367	Nov 05, 2026	Samsung Baseband Firmware NAS DLTransport Improper Handling Crash Improper handling of NAS DLTransport messages may lead to a baseband crash.	Exynos
CVE-2025-66368	Nov 05, 2026	Samsung Exynos SDP payload DoS (CVE-2025-66368) Incorrect handling of SDP payload leads to a Denial of Service	Exynos
CVE-2026-33958	Nov 05, 2026	Samsung RRC Reconfig OOB DoS Vulnerability Processing a malformed RRC Reconfiguration message leads to an out-of-bounds (OOB) access, resulting in a denial-of-service (DoS) condition.	Exynos
CVE-2026-33971	Nov 05, 2026	CVE-2026-33971: LTE RRC Improper Message Handling Causes DoS In the LTE RRC component, improper handling of messages before authentication triggers a data abort, which leads to a denialofservice condition.	Exynos
CVE-2026-33969	Nov 05, 2026	Samsung NAS Auth Req Decode DoS via Missing Bounds Check In the NAS Authentication Request message decoding procedure, a missing lower bound check causes an infinite loop, leading to Denial of Service.	Exynos
CVE-2026-33972	Nov 05, 2026	Exynos Modem IMS OOB Access Vulnerability (CVE-2026-33972) In the Exynos modem's IMS stack, Out of Bound access occurs due to improper validation.	Exynos
CVE-2026-48179	Nov 05, 2026	Samsung Exynos Modem IMS Stack SDP Payload DoS In the Exynos modem's IMS stack, improper handling of SDP payload leads to a Denial of Service	Exynos
CVE-2026-48176	Nov 05, 2026	Samsung Exynos SoC memory corruption (improper message validation) A memory corruption vulnerability caused by improper validation of messages	Exynos
CVE-2026-35495	Nov 05, 2026	Samsung Exynos IMS SIP Improper Access Control (CVE-2026-35495) In IMS stack, improper handling of SIP packets leads to Incorrect_Access_Control vulnerability	Exynos
CVE-2025-66364	Nov 05, 2026	Samsung Baseband Firmware Crash via Repeated Control Plane msgs Continuously sending controlplane messages causes the baseband to crashes.	Exynos
CVE-2026-21157	Oct 29, 2026	Bixby <4.0.85.6: Local Int. Validation Flaw Enables Arbitrary Activity Improper input validation in Bixby prior to version 4.0.85.6 allows privileged local attackers to launch arbitrary activity.	Bixby
CVE-2026-21139	Oct 12, 2026	Samsung Continuity Service Windows Improper Access Control <4.6.1217 Improper access control in Samsung Continuity Service for windows prior to version 4.6.1217.0 allows adjacent attackers to manipulate the connected mobile device.
CVE-2026-21138	Oct 12, 2026	Samsung Smart Switch <3.7.73: No auth check, phys. attacker installs apps Insufficient verification of data authenticity in Smart Switch prior to version 3.7.73 allows physical attackers to install arbitrary applications.
CVE-2026-21137	Oct 12, 2026	Path Traversal in Samsung Smart Switch <3.7.73 (Android) Path traversal in Smart Switch prior to version 3.7.73 allows physical attackers to access files with Smart Switch privilege.
CVE-2026-21136	Oct 12, 2026	Samsung Smart Switch (<3.7.73) Improper Auth: Physical Attacker Invoke Restore Improper authorization in Smart Switch prior to version 3.7.73 allows physical attackers to invoke application restore process.
CVE-2026-21135	Oct 12, 2026	Samsung Internet Access Control Vulnerability pre-30.0.5.6 Improper access control in Samsung Internet prior to version 30.0.5.6 allows local attackers to access sensitive information.	Internet
CVE-2026-21134	Oct 12, 2026	Samsung Flow Improper Auth Adjacent Attack (4.9.22.4) Improper authentication in Samsung Flow prior to version 4.9.22.4 allows adjacent attackers to access sensitive information.	Samsung Flow
CVE-2026-21133	Oct 12, 2026	Samsung Flow Path Traversal <4.9.22.1 Allows Clipboard Access Path traversal in Samsung Flow prior to version 4.9.22.1 allows local attackers to access clipboard data.	Samsung Flow
CVE-2026-21132	Oct 12, 2026	Samsung Internet <30.0.5.24: Improper Input Validation Allows Script Injection Improper input validation in Samsung Internet prior to version 30.0.5.24 allows remote attackers to inject arbitrary script. User interaction is required for triggering this vulnerability.	Internet
CVE-2026-21131	Oct 12, 2026	Samsung Flow 4.9.22.4 Local Permission Escalation via Incorrect Default Permission Incorrect default permission in Samsung Flow prior to version 4.9.22.4 allows local attackers to launch an arbitrary activity with Samsung Flow privileges on the connected device.	Samsung Flow
CVE-2026-21130	Oct 12, 2026	Samsung Checkout CreditCardRetrieveActivity Input Validation flaw before v5.1.03.1 Improper input validation in CreditCardRetrieveActivity of Samsung Checkout prior to version 5.1.03.1 allows local attackers to launch an arbitrary activity with Samsung Checkout privileges.	Checkout
CVE-2026-21129	Oct 12, 2026	Samsung Checkout <5.1.03.1 Improper Input Validation in GuestCCRegisterActivity Improper input validation in GuestCreditCardRegisterActivity of Samsung Checkout prior to version 5.1.03.1 allows local attackers to launch an arbitrary activity with Samsung Checkout privileges.	Checkout
CVE-2026-21128	Oct 12, 2026	Samsung Checkout before 5.1.03.1: CVE-2026-21128 Improper Input Validation Improper input validation in CreditCardRegisterActivity of Samsung Checkout prior to version 5.1.03.1 allows local attackers to launch arbitrary activity with Samsung Checkout privileges.	Checkout
CVE-2026-21127	Oct 12, 2026	Samsung Account Android app components improper export v<15.7.01.1 Improper export of android application components in Samsung Account prior to version 15.7.01.1 allows local attackers to access sensitive data.	Account
CVE-2026-21126	Oct 12, 2026	Samsung libsimba.heifdec.media.samsung.so OOB Write via Improper Input Validation Improper input validation in getting cover image in libsimba.heifdec.media.samsung.so prior to SMR Oct-2026 Release 1 allows local attackers to write out-of-bounds memory.	Samsung Mobile Devices
CVE-2026-21125	Oct 12, 2026	Samsung Mobile libsimba.heifdec Input Val Flaw (CVE-2026-21125) Improper input validation in parsing sheifd in libsimba.heifdec.media.samsung.so prior to SMR Oct-2026 Release 1 allows local attackers to potentially execute arbitrary code.	Samsung Mobile Devices
CVE-2026-21124	Oct 12, 2026	Samsung Mobile libsimba.heifdec: Improper Input Validation, Local RCE Improper input validation in getting cover image in libsimba.heifdec.media.samsung.so prior to SMR Oct-2026 Release 1 allows local attackers to potentially execute arbitrary code.	Samsung Mobile Devices