Samsung Android CVE-2025-21044

Exploitation requires the attacker to already hold high privileges (PR:H) with local access (AV:L) on a Samsung Android 13 device running a security maintenance release prior to SMR Oct-2025 Release 1, and to be able to reach the fingerprint trustlet's interface to supply input that triggers the out-of-bounds write. No user interaction is needed (UI:N). The key limiting factors are the mandatory pre-existing privileged local foothold - this cannot be triggered remotely or by an unprivileged app under default configuration - and the requirement that the device has not applied the October 2025 or later Samsung security patch. These constraints make opportunistic or at-scale exploitation impractical and confine realistic use to post-compromise scenarios.

This is a genuinely low-priority vulnerability by every available signal. The CVSS base score is 4.4 (Medium) with a vector of AV:L/AC:L/PR:H/UI:N - local attack vector requiring high privileges, meaning the attacker must already have significant access on the device before exploitation. EPSS reinforces this: 0.12% probability in the 2nd percentile indicates essentially no observed or predicted mass exploitation. There is no CISA KEV listing and no public exploit code identified, so this is 'no public exploit identified at time of analysis.' SSVC-style reasoning points to the same conclusion: not actively exploited, not realistically automatable (requires prior privileged local foothold and a trustlet-specific corruption primitive), and the technical impact is partial/confined to a trusted-execution component rather than full system takeover. One notable internal inconsistency: the provided CVSS vector sets C:H (high confidentiality impact) with I:N/A:N, yet the CWE is CWE-787 (out-of-bounds WRITE) and the description states the attacker can 'write out-of-bounds memory' - a write primitive would normally manifest as an integrity (and possibly availability) impact, not pure confidentiality. This C:H/I:N labeling should be verified against Samsung's SMR advisory; it may reflect that the corruption ultimately enables disclosure of protected biometric data within the trustlet, but the public data does not confirm that. Bottom line: a high-CVSS-component (confidentiality) does not elevate this to a real-world priority given the local, high-privilege precondition and negligible exploitation signals.

An attacker who has already achieved privileged code execution on a Samsung Android 13 device (e.g., via a prior root/system-level compromise or a malicious privileged app) invokes the fingerprint trustlet and supplies crafted input that triggers an out-of-bounds write in its memory. This local, high-privilege precondition means it is not a remote or drive-by threat; no public proof-of-concept exists, and realistic use would be as a post-exploitation step to corrupt or disclose data within the trusted execution environment.