Samsung Notes
CVE-2025-21067
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local low-privileged app execution
-
ExploitSupply crafted image to Samsung Notes
-
ExecutionTrigger out-of-bounds read in buffer allocation
-
ImpactLeak adjacent heap memory contents
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires local, low-privileged code execution on the Samsung device (PR:L) - typically a malicious or compromised app - that can drive Samsung Notes' image-buffer allocation path with attacker-controlled image data to trigger the out-of-bounds read; no user interaction is needed (UI:N). Exploitation is LIMITED to versions prior to 4.4.30.63 (patched above this), to the local attack surface (no remote/network vector), and to information disclosure of adjacent memory rather than code execution. There is no network-exposed or unauthenticated path, which substantially constrains real-world risk relative to the 7.1 score. |
| Impact | This is a genuinely mid-tier, not top-priority, issue once all signals are weighed together. The 7.1 CVSS reflects high confidentiality and availability sub-scores, but the base vector is local (AV:L) and requires at least low privileges (PR:L), meaning an attacker must already be executing code on the device (e.g. a malicious or compromised app) rather than reaching it over the network. EPSS reinforces low real-world urgency at 0.12% (2nd percentile), and there is no CISA KEV listing and no public exploit identified, so there is no evidence of active or opportunistic exploitation. The impact is an out-of-bounds READ (CWE-125) - fundamentally an information-disclosure/crash primitive, not memory corruption leading to code execution, so the I:N in the vector is consistent with the description. One discrepancy to verify: the vendor vector asserts A:H, but the description only states that attackers can 'access out-of-bounds memory' and does not describe a crash or denial of service - the availability impact appears inferred (likely from a potential app crash) rather than explicitly documented, so treat A:H as unconfirmed. Net: a real but modest local defense-in-depth issue, appropriately remediated by patching, not an emergency. |
| Exploit ScenarioDerived | A malicious or compromised application already present on a Samsung device feeds a crafted image to Samsung Notes (or its shared image-handling path), causing the vulnerable image-buffer allocation to read past its bounds and expose adjacent heap memory that may contain sensitive data from the notes application or process. Because UI:N, no victim interaction is needed once the malicious code runs locally, but the attacker must first hold local, low-privileged execution on the device. No public proof-of-concept exploit has been identified. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Out-of-bounds read in Samsung Notes' image-buffer allocation path lets a locally installed, low-privileged app read adjacent process memory on all builds prior to 4.4.30.63. Exploitation requires local code execution with low privileges (PR:L per the assessed CVSS vector) and no user interaction, and the outcome is bounded to information disclosure of out-of-bounds memory rather than code execution, with at most a Low availability impact from a possible app crash. Our assessment rates this as a genuinely mid-tier issue: the strictly local attack surface heavily constrains real-world risk compared with the vendor's 7.1 score, EPSS is only 0.12% (2nd percentile), and no public exploit identified at time of analysis; confirmed actively exploited status has not been established (no CISA KEV listing).
RemediationAI
Vendor-released patch: update Samsung Notes to version 4.4.30.63 or later, distributed through the Galaxy Store or Google Play, or via the October 2025 Samsung maintenance/firmware release referenced in the advisory at https://security.samsungmobile.com/serviceWeb.smsb?year=2025&month=10; verify the installed version in Samsung Notes settings after updating, since older builds may remain if auto-update is disabled. Where immediate updating is not possible, apply compensating controls knowing their trade-offs: block sideloading and restrict app installation to store-signed packages via Samsung Knox/Android Enterprise policies (reduces the malicious-app vector but can break internal app distribution), keep device firmware at the October 2025 level or later (may be delayed on carrier-locked units), and avoid opening note files or images received from untrusted sources and avoid granting untrusted apps the ability to share content into Samsung Notes (impairs normal sharing workflows). Restricting the low-privileged execution context that the attack requires - for example through Android's app sandbox, permission review and Knox app-isolation - lowers exposure but does not remove the underlying read primitive. There is no indication that mitigation alone is sufficient; patching to 4.4.30.63 remains the primary fix, and note that no vendor-released patch is available for builds the vendor no longer supports.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic CWE-125 out-of-bounds read in the memory-allocation logic Samsung Notes uses when handling image data (for example, images embedded in or imported into notes). When the app computes and allocates a buffer for an image whose size or dimensions are attacker-influenced, a missing or incorrect bounds check allows the subsequent processing to read past the end of the allocated region, returning heap contents to the caller. Because the primitive is a read, not a write, impact is confined to memory disclosure - leaked heap data, object metadata and potentially pointers useful for ASLR bypass - with no direct path to code execution; the assessed vector instead assigns C:H/I:N/A:L, reflecting the leak and only a low likelihood of crashing the app. Attack surface is local only (AV:L, PR:L, UI:N): a malicious or compromised Android app on the device, or a crafted file delivered through the app's local parsing path, must drive the image-buffer allocation code in Samsung Notes. The supplied CPE cpe:2.3:a:samsung:notes:*:*:*:*:*:*:*:* uses a wildcard version, so the authoritative affected range comes from the vendor advisory: Samsung Notes releases older than 4.4.30.63. There is no network-exposed, pre-authentication path, and the vendor advisory (Samsung Mobile Security, October 2025) credits mobile.security@samsung.com as the reporter, indicating an internally or coordinated-disclosure-sourced finding rather than an observed exploitation campaign.
Know when Notes gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Local app-level access needed (AV:L, PR:L); an OOB read discloses heap memory (C:H) and at most crashes the app (A:L, downgraded from vendor A:H as no DoS is described); no integrity impact (I:N).
Primary rating from NVD.
CVSS VectorNVD
DescriptionNVD
Out-of-bounds read in the allocation of image buffer in Samsung Notes prior to version 4.4.30.63 allows local attackers to access out-of-bounds memory.
Executive ViewAI
Samsung Notes on Android, in builds prior to 4.4.30.63, contains an out-of-bounds read that a locally installed low-privileged app could exploit to disclose adjacent process memory, potentially exposing sensitive note content or other in-memory data. Because exploitation requires a malicious local app and no vendor-released patch is identified at time of analysis, leadership should treat this as a manageable but unpatched mobile information-disclosure risk for Samsung Notes users. No public exploit identified at time of analysis, and EPSS is very low, so immediate broad compromise is unlikely, but unpatched exposure on managed mobile devices warrants focused mitigation.
No vendor-released patch identified at time of analysis. Interim mitigations include enforcing mobile app allowlisting and blocking sideloaded or untrusted apps, restricting low-privileged app installation through MDM, monitoring Samsung Notes for abnormal crashes or memory-access behavior, limiting storage of highly sensitive data in Samsung Notes, and applying current Android security updates and device encryption.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Affected Products (CPE)NVD
Stack-based out-of-bounds write in Samsung Notes prior to version 4.4.21.62 allows remote attackers to execute arbitrary
A vulnerability in the MIME message handling of the HCL Notes v9 client could potentially be exploited by an unauthentic
A vulnerability in the MIME message handling of the Notes client (versions 9 and 10) could potentially be exploited by a
A vulnerability in the input parameter handling of HCL Notes v9 could potentially be exploited by an authenticated attac
Heap-based out-of-bounds write in Samsung Notes prior to version 4.4.21.62 allows local attackers to execute arbitrary c
Path traversal in Samsung Notes prior to version 4.4.21.62 allows local attackers to execute arbitrary code. Rated high
Out-of-bounds write in applying connected information in Samsung Notes prior to version 4.4.21.62 allows local attackers
Out-of-bounds write in appending paragraph in Samsung Notes prior to version 4.4.21.62 allows local attackers to potenti
HCL Notes is susceptible to a stack based buffer overflow vulnerability in lasr.dll in Micro Focus KeyView. Rated high s
HCL Notes is susceptible to a stack based buffer overflow vulnerability in wp6sr.dll in Micro Focus KeyView. Rated high
HCL Notes is susceptible to a stack based buffer overflow vulnerability in lasr.dll in Micro Focus KeyView. Rated high s
A possible buffer overflow vulnerability in maetd_eco_cb_mode of libSPenBase library of Samsung Notes prior to Samsung N
GitHub PoC
Exploit-DB