Samsung Android CVE-2025-21052

Requires local access with at least low privileges (PR:L) - in practice a malicious or compromised app running on the Samsung Android 13 device that can route a crafted JPEG into a component backed by libpadm.so. The out-of-bounds write only occurs under a 'specific condition' during JPEG pre-processing (the exact malformed-image trigger is not detailed in the available data), so not every JPEG will fire the bug. Limiting factors: no remote/network vector (AV:L), the attacker must already be able to run code or deliver input locally, and devices patched at SMR Oct-2025 Release 1 or later are not affected. No user interaction is required (UI:N) once the malicious input is delivered.

This is a genuine but second-tier priority: a high-CVSS (7.8) local privilege-escalation/memory-corruption flaw whose real-world risk signals point to opportunistic rather than widespread exploitation. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms a LOCAL attack vector requiring some pre-existing privilege (PR:L) - not remote, despite JPEG decoding sometimes being reachable over the network; the input data does not show a remote delivery path, so network exploitation is not substantiated. EPSS is very low (0.13%, 2nd percentile) and there is no CISA KEV listing and no referenced public exploit, so there is no evidence of active exploitation or weaponized POC. The high triad impact (C:H/I:H/A:H, scope unchanged) reflects potential code execution within the context that invokes libpadm.so. These signals are internally consistent: a serious memory-corruption bug that in practice requires a local malicious app or local access, making it a chaining component for jailbreak/privesc rather than a mass-exploitation threat. Note the 'specific condition' qualifier in the description means not all JPEG inputs trigger the bug - the exact trigger condition is not disclosed in the provided data and should be verified against Samsung's SMR Oct-2025 bulletin.

A malicious or compromised app installed on a Samsung Android 13 device supplies a specially crafted JPEG to a system component that uses libpadm.so for decoding, triggering an out-of-bounds write during pre-processing. The resulting memory corruption can be shaped to corrupt adjacent data or control flow, enabling code execution or privilege escalation in the decoding process's context. No public exploit identified at time of analysis; exploitation requires local code execution with at least low privileges (PR:L).