Samsung Android CVE-2025-21053

Exploitation requires local access on an affected Samsung Android 13 device - specifically the ability to run code or an app (PR:L) that can supply attacker-controlled image data to the JPEG decoding path in libpadm.so, whose header parser contains the out-of-bounds write. The flaw is reached by processing a crafted JPEG header, so the limiting factors are: the attacker must already be present on the device (no remote/network vector, AV:L), must hold at least low privileges, and the device must be running a Samsung Android 13 build at a security maintenance release prior to SMR Oct-2025 Release 1 (patched builds are not affected). No user interaction is required (UI:N).

Signals are consistent and point to a genuine but locally-scoped risk. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes a locally-exploitable, low-complexity, low-privilege flaw with high impact to confidentiality, integrity, and availability - the classic profile of an out-of-bounds write (CWE-787) reached by a malicious or compromised local app. Exploitation signals are notably weak: EPSS is only 0.13% (2nd percentile), the CVE is NOT in CISA KEV, and no public POC is indicated, so there is no public exploit identified at time of analysis and no evidence of active exploitation. SSVC framing would place this as Exploitation=none, Automatable=no (local vector requires code already running on-device), Technical Impact=total. The combination of a local-only vector with no public exploit and very low EPSS means this is a meaningful patch-worthy defect for Samsung device fleets but NOT an emergency internet-facing threat - it is a credible privilege-escalation/memory-corruption primitive rather than a widely-exploited one. All signals align here; there is no conflict between CVSS and the description, both of which agree on local access (AV:L matches 'allows local attackers').

A low-privileged malicious or compromised Android application installed on an affected Samsung device feeds a specially crafted JPEG with a malformed header to the vulnerable libpadm.so decoder. Parsing the crafted header triggers an out-of-bounds write that corrupts memory, which a skilled attacker can shape toward code execution or privilege escalation in the context of the image-handling process. No public exploit code is identified at time of analysis, and the local attack vector requires the attacker to already have code execution on the device.