Samsung Voice Recorder CVE-2025-21063

Requires physical possession of the target device and interaction with the Samsung Voice Recorder functionality exposed on the lock screen while the device remains locked; the affected app must be a version prior to 21.5.73.12 (Android 15) or 21.5.81.40 (Android 16). The dominant limiting factor is the physical attack vector (AV:P) - the flaw cannot be triggered remotely or at scale, so realistic risk is confined to lost/stolen/unattended devices. Impact is limited to disclosure of recording files (C:H); no modification or denial of service is possible.

This is a genuinely low-priority issue despite the HIGH confidentiality impact in the CVSS vector. The CVSS 3.1 base score of 4.6 (Medium) is held down by the physical attack vector (AV:P), which is the single most limiting factor: an attacker must have hands-on possession of the unlocked-screen device. All signals agree on low real-world risk - EPSS is 0.17% (6th percentile), there is no CISA KEV listing, and no public exploit code has been identified. The only elevated metric is C:H, reflecting that recorded audio files (potentially sensitive) can be read. There is no integrity or availability impact (I:N/A:N). No signals conflict: a physical-access confidentiality bug with low EPSS and no exploitation evidence is a device-level, opportunistic-theft concern rather than a scalable or remotely exploitable threat. Note the vendor-supplied vector lists PR:N (no authentication), which is consistent with the flaw being a lock-screen access-control bypass - the lock screen is the control that fails.

An attacker who obtains temporary physical possession of a victim's Samsung Galaxy phone (e.g., a lost, stolen, or momentarily unattended device) interacts with the Voice Recorder surface exposed on the lock screen and reads saved recording files without unlocking the device. No public exploit code is known; exploitation requires only manual interaction, no special tooling.