Samsung Android CVE-2025-21051

Exploitation requires local access to a Samsung Android device (CVSS AV:L) with at least low privileges (PR:L) - in practice, an attacker-controlled or compromised application able to feed a crafted JPEG into the vulnerable pre-processing routine in libpadm.so. The specific trigger is JPEG decode pre-processing in libpadm.so on builds prior to SMR Oct-2025 Release 1 (Android 13.0 affected per CPE). Limiting factors: there is no network vector, so remote unauthenticated exploitation is not possible; the attacker must already run code or deliver input locally, and devices patched at SMR Oct-2025 R1 or later are not affected. No user interaction is required once the malicious image reaches the decoder (UI:N).

This is a credible but not emergency-priority local privilege/memory-corruption issue. The CVSS vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) indicates a local attack vector requiring low privileges and no user interaction, with full confidentiality, integrity, and availability impact on the affected component - consistent with CWE-787 out-of-bounds write. However, the exploitation-likelihood signals are low: EPSS is only 0.13% (2nd percentile), the CVE is NOT on the CISA KEV list (no confirmed active exploitation), and no public exploit code is identified in the provided data. SSVC-style framing: exploitation status is 'none' (no public exploit identified at time of analysis), the flaw is not automatable (requires local code execution to deliver a crafted JPEG), and technical impact is total for the affected process. The signals are internally consistent - a high-impact-but-locally-gated bug with low real-world exploitation probability - so there is no conflict to flag, but the local-only vector (AV:L) means this is NOT a remotely wormable mass-exploitation risk. It is a legitimate patch item (especially as part of normal Samsung SMR cadence) rather than a drop-everything emergency.

A malicious or compromised Android application installed on a Samsung device supplies a specially crafted JPEG image that is handed to the vulnerable pre-processing path in libpadm.so. When the library decodes the image, the out-of-bounds write corrupts adjacent memory, which a local attacker can leverage toward memory corruption and potential privilege escalation or code execution in the context of the affected process. No public exploit code is identified at time of analysis, and the attack requires local access with at least low privileges (e.g., an installed app).