Summary
Ein Angreifer kann mehrere Schwachstellen in Samsung Android ausnutzen, um seine Privilegien zu erhöhen, um Sicherheitsvorkehrungen zu umgehen, um Informationen offenzulegen, und um Dateien zu manipulieren.
Product
Das Android Betriebssystem ist eine quelloffene Plattform für mobile Geräte. Die Basis bildet der Linux-Kernel.
Vulnerabilities 49
-
High 8.4
In multiple locations, there is a possible way to achieve code execution due to an integer overflow. This could lead to…
KEV Jun 2, 2026 -
Critical 9.8
An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1280, 1…
-
Critical 9.8
An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1280, 1…
-
High 8.8
Integer Overflow or Wraparound in GPS
Memory corruption when decoding corrupted satellite data files with invalid signature offsets.
-
High 8.0
In multiple functions of sdp_discovery.cc, there is a possible way to achieve code execution due to a heap buffer overf…
-
High 8.0
In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation o…
-
High 7.8
In multiple locations, there is a possible way to reveal images across users due to improper input validation. This cou…
-
High 7.8
In resolveContentProvider of ComputerEngine.java, there is a possible way to access URIs across users due to a logic er…
-
High 7.8
In multiple locations, there is a possible way to reset user-selected permissions selections due to a permissions bypas…
-
High 7.8
In startAnimation of StageCoordinator.java, there is a possible tapjacking issue due to a tapjacking/overlay attack. Th…
-
High 7.8
In bta_jv_rfcomm_connect of bta_jv_act.cc, there is a possible bypass of bonding for a secure connection due to a logic…
-
High 7.6
Buffer Over-read in WLAN Firmware
Transient DOS when receiving a service data frame with excessive length during device matching over a neighborhood awareness network protocol connection.
-
High 7.1CVE-2025-64720 Public exploit
LIBPNG is vulnerable to a buffer overflow in `png_image_read_composite` via incorrect palette premultiplication
LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, an out-of-bounds read vulnerability exists in png_image_read_composite when proces…
-
High 7.1CVE-2025-65018 Public exploit
LIBPNG is vulnerable to a heap buffer overflow in `png_combine_row` triggered via `png_image_finish_read`
LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, there is a heap buffer overflow vulnerability in the libpng simplified API functio…
-
High 7.0
An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor amd Wearable Processor Exynos 980, 850, 1080, 1…
-
High 7.0
An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1080, 1…
-
Medium 6.8
In hide of WindowState.java, there is a possible way to trick the user into approving permissions due to a tapjacking/o…
-
Medium 6.8CVE-2026-21012 Public exploit
External control of file name in AODManager prior to SMR Apr-2026 Release 1 allows privileged local attacker to create …
-
Medium 6.6CVE-2026-21010 Public exploit
Improper input validation in Retail Mode prior to SMR Apr-2026 Release 1 allows local attackers to trigger privileged f…
-
Medium 6.5
Reachable Assertion in FW
Transient DOS when MAC configures config id greater than supported maximum value.
-
Medium 6.5
In multiple functions of ubsan_throwing_runtime.cpp, there is a possible persistent denial of service due to an integer…
-
Medium 6.5
In multiple functions of ubsan_throwing_runtime.cpp, there is a possible way to cause a crash due to an integer overflo…
-
Medium 6.5
In multiple functions of ubsan_throwing_runtime.cpp, there is a possible UBSan failure due to an integer overflow. This…
-
Medium 6.5
In multiple functions of ubsan_throwing_runtime.cpp, there is a possible way to cause the system to crash due to an int…
-
Medium 6.5
In multiple functions of ubsan_throwing_runtime.cpp, there is a possible way to cause a crash due to an integer overflo…
-
Medium 6.5
In multiple functions of ubsan_throwing_runtime.cpp, there is a possible way to cause a crash due to an integer overflo…
-
Medium 6.5
In Modem, there is a possible system crash due to a logic error. This could lead to remote denial of service, if a UE h…
-
Medium 6.2
In InputInterceptor of Letterbox.java, there is a possible way to trick a user into accepting a permission due to a tap…
-
Medium 6.2CVE-2026-0049 Public exploit
In onHeaderDecoded of LocalImageResolver.java, there is a possible persistent denial of service due to resource exhaust…
-
Medium 6.2
In createSessionInternal of PackageInstallerService.java, there is a possible to update a Device Policy Controller (DPC…
-
Medium 6.1
LIBPNG is vulnerable to a heap buffer overflow in `png_do_quantize` via malformed palette index
LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to version 1.6.51, a heap buffer over-read vulnerability exists in libpng's png_do_quantize function when process…
-
Medium 5.5
In multiple files, there is a possible way to reveal information across users due to a missing permission check. This c…
-
Medium 5.5
In multiple functions of AccessibilityManagerService.java, there is a possible persistent denial of service due to impr…
-
Medium 5.5
In multiple functions of ubsan_throwing_runtime.cpp, there is a possible persistent denial of service due to resource e…
-
Medium 5.5
In multiple functions of ubsan_throwing_runtime.cpp, there is a possible persistent denial of service due to an integer…
-
Medium 5.5
In multiple functions of ubsan_throwing_runtime.cpp, there is a possible way to cause a permanent denial of service due…
-
Medium 5.5
In multiple functions of ubsan_throwing_runtime.cpp, there is a possible persistent denial of service due to an integer…
-
Medium 5.4CVE-2026-21011 Public exploit
Incorrect privilege assignment in Bluetooth in Maintenance mode prior to SMR Apr-2026 Release 1 allows physical attacke…
-
Medium 5.2CVE-2026-21003 Public exploit
Improper input validation in data related to network restrictions prior to SMR Apr-2026 Release 1 allows physical attac…
-
Medium 5.1CVE-2026-21008 Public exploit
Exposure of sensitive information in S Share prior to SMR Apr-2026 Release 1 allows adjacent attacker to access sensiti…
-
Medium 4.7CVE-2026-21006 Public exploit
Improper access control in Samsung DeX prior to SMR Apr-2026 Release 1 allows physical attackers to access to hidden no…
-
Medium 4.6
In preloader, there is a possible read of device unique identifiers due to a logic error. This could lead to local info…
-
Medium 4.4CVE-2026-21007 Public exploit
Improper check for exceptional conditions in Device Care prior to SMR Apr-2026 Release 1 allows physical attackers to b…
-
Medium 4.1CVE-2026-21009 Public exploit
Improper check for exceptional conditions in Recents prior to SMR Apr-2026 Release 1 allows physical attacker to bypass…
-
Medium 4.0
In importWrappedKey of KMKeymasterApplet.java, there is a possible way access keys that should be restricted due to imp…
-
Low 3.3
In multiple functions of KeyguardViewMediator.java , there is a possible way to bypass lockdown mode with screen pinnin…
-
Low 3.3
In updateProvidersWhenServiceRemoved of CredentialManagerService.java, there is a possible way to override settings acr…
-
Low 3.3
In handleBondStateChanged of AdapterService.java, there is a possible sensitive information disclosure due to a permiss…
-
Low 3.3
In setTo of ResourceTypes.cpp, there is a possible read out of bounds due to an incorrect bounds check. This could lead…
Revision history
-
#4
Referenz(en) aufgenommen: EUVD-2026-33772, EUVD-2026-33784, EUVD-2026-33787, EUVD-2026-33776, EUVD-2026-33777, EUVD-2026-33778, EUVD-2026-33779, EUVD-2026-33782, EUVD-2026-33781, EUVD-2026-33783, EUVD-2026-33768, EUVD-2026-33769, EUVD-2026-33770, EUVD-2026-33771, EUVD-2026-33773, EUVD-2026-33774, EUVD-2025-210014, EUVD-2025-210009, EUVD-2025-210013, EUVD-2025-210008, EUVD-2026-33795, EUVD-2026-33796, EUVD-2026-33775, EUVD-2026-33767, EUVD-2025-210016
-
#3
Referenz(en) aufgenommen: GHSA-FF89-7R94-6Q4Q, EUVD-2026-21866, EUVD-2026-21862, EUVD-2026-21816, EUVD-2026-21858, EUVD-2026-21856, EUVD-2026-21864, EUVD-2026-21860
-
#2
Referenz(en) aufgenommen: EUVD-2025-209267, EUVD-2025-209266
-
#1
Initiale Fassung
References
-
Samsung Security Updates April 2026 vom 2026-04-06
https://security.samsungmobile.com/securityUpdate.smsb