Samsung Notes
CVE-2025-21068
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain low-privilege local foothold on device
-
ExploitDeliver crafted image to Samsung Notes
-
ExecutionTrigger out-of-bounds read in image parser
-
ImpactLeak adjacent out-of-bounds memory
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires local access to the device plus the ability to have Samsung Notes (version earlier than 4.4.30.63) process attacker-influenced image data - i.e., the attacker needs a pre-existing low-privilege foothold such as a malicious installed app or the ability to get a crafted image opened in Notes (AV:L/PR:L). Limiting factors: there is no remote/network attack path, the flaw is an out-of-bounds read yielding memory disclosure rather than code execution or write primitive, and devices updated to 4.4.30.63 or later are not affected. No user interaction is required per the vector (UI:N). |
| Impact | This is a genuine but comparatively low-urgency issue. The CVSS vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H, score 7.1) describes a LOCAL (AV:L), low-complexity flaw requiring low-level privileges (PR:L), meaning an attacker must already have code execution or an app foothold on the Samsung device - it is not remotely exploitable. The exploitation-probability signals are weak and consistent: EPSS is 0.12% (2nd percentile), there is no CISA KEV listing, and no public exploit was identified at time of analysis. There is no SSVC decision data provided. One internal inconsistency to verify: the vector claims A:H (high availability impact), but the description characterizes the flaw purely as an out-of-bounds READ allowing access to out-of-bounds memory (CWE-125), which is primarily a confidentiality/information-disclosure problem - an OOB read could cause a crash (justifying some availability impact) but the vendor's A:H rating is not substantiated by the description text. Net assessment: a legitimate medium-severity local information-disclosure bug that is a routine patch priority, not an emergency; the local attack vector and absence of exploitation evidence sharply limit real-world risk despite the 7.1 'High' label. |
| Exploit ScenarioDerived | A malicious or compromised app already present on a Samsung device, or a crafted image file opened in Samsung Notes, triggers the vulnerable image-parsing routine in a version prior to 4.4.30.63. The out-of-bounds read leaks adjacent process memory, potentially exposing sensitive data or defeating memory-layout protections. No public exploit code is known, and exploitation requires an existing low-privilege local foothold (AV:L/PR:L). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
An out-of-bounds read (CWE-125) in how Samsung Notes parses image data allows a locally positioned attacker to read past the end of an allocated buffer and expose out-of-bounds memory contents; versions prior to 4.4.30.63 are affected. Exploitation requires a pre-existing low-privilege foothold on the device - a malicious installed app or the ability to get a crafted image opened in Notes - with no network attack path and no user interaction required once that foothold exists (CVSS:3.1/AV:L/AC:L/PR:L/UI:N). The impact is confidentiality-focused memory disclosure rather than code execution or a write primitive; there is no public exploit identified at time of analysis, CISA KEV does not list it, and EPSS is only 0.12% (2nd percentile), so this is a genuine but comparatively low-urgency issue that is fully resolved by updating to 4.4.30.63 or later.
RemediationAI
Apply the vendor fix by updating Samsung Notes to version 4.4.30.63 or later - delivered through the Galaxy Store (or Google Play) app update or via an OEM/carrier firmware release that includes the patched build - and confirm the installed version under the app's settings; the vendor advisory is at https://security.samsungmobile.com/serviceWeb.smsb?year=2025&month=10. Samsung's monthly security maintenance releases typically roll the Notes update with the October 2025 SMR, so organizations managing Galaxy fleets should enforce that SMR level through an MDM/EMM policy that blocks deferral of system and app updates, and should audit for sideloaded or older Notes APKs that bypass store updates. Because the attack path is local only, network-layer controls are irrelevant; the effective compensating controls are reducing the local attack surface. Specifically: restrict installation of apps from unknown sources and enforce Google Play Protect or a managed allowlist (trade-off: blocks legitimate sideloading workflows); treat images received from untrusted sources as hostile and avoid handing them to Notes (trade-off: user-discipline dependent, not technically enforceable); and consider running Notes and untrusted apps in separate work profiles so a low-privilege app cannot readily feed crafted images into the Notes data path (trade-off: added user friction and some cross-profile sharing limitations). Since the primitive is an out-of-bounds read yielding memory disclosure, these controls lower the probability of a leak of process memory but do not eliminate it until the 4.4.30.63 update is installed.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic out-of-bounds read (CWE-125) in the image-decoding path of Samsung Notes, the vendor's preinstalled note-taking application on Galaxy devices. When the app processes image data, insufficient bounds validation on the parsed data causes a read beyond the bounds of an allocated buffer, leaking adjacent heap memory back into the processing context. Because the primitive is read-only, the realistic outcome is information disclosure (and, depending on the vendor vector's availability component, potential process instability) rather than memory corruption leading to code execution. The affected component is identified in CPE terms as cpe:2.3:a:samsung:notes:*:*:*:*:*:*:*:*, with the version boundary defined by the vendor as anything earlier than 4.4.30.63. This is a local (AV:L) attack surface: the attacker must already be running code on the device at low privilege (PR:L) or be able to influence the image content that Notes opens; there is no remote or network vector. The vulnerability is self-reported by Samsung's mobile security team (mobile.security@samsung.com) and documented in the Samsung Mobile Security October 2025 bulletin. Note that our independent assessment rates the impact as confidentiality-only (C:H/I:N/A:N), which is lower than the vendor-published CVSS 3.1 score of 7.1 whose vector also assigns availability impact.
Know when Notes gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Local app-context flaw needing a low-privilege foothold (AV:L/PR:L); it is a read-only memory disclosure (C:H, I:N), and I set A:N since the description cites only memory access, not a crash, diverging from the vendor's A:H.
Primary rating from NVD.
CVSS VectorNVD
DescriptionNVD
Out-of-bounds read in the reading of image data in Samsung Notes prior to version 4.4.30.63 allows local attackers to access out-of-bounds memory.
Executive ViewAI
Samsung Notes on managed mobile devices running versions prior to 4.4.30.63 contains a memory disclosure flaw that can leak small amounts of application memory to an already-present malicious app on the same device. The issue only matters where an attacker has already obtained a low-privilege foothold, meaning it is a secondary capability that amplifies post-compromise data theft rather than a way in. Leadership should treat it as a compliance and hardening item for the mobile fleet, not an emergency, and should prioritize confirming that patched Notes builds are deployed across the estate.
Apply vendor patch. Where 4.4.30.63 cannot be deployed immediately, restrict the attack precondition by enforcing strict application allow-listing and blocking sideloaded or untrusted apps on affected devices, and prevent untrusted sources from delivering crafted images into Samsung Notes; these reduce exposure but do not remediate the underlying out-of-bounds read.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Affected Products (CPE)NVD
Stack-based out-of-bounds write in Samsung Notes prior to version 4.4.21.62 allows remote attackers to execute arbitrary
A vulnerability in the MIME message handling of the HCL Notes v9 client could potentially be exploited by an unauthentic
A vulnerability in the MIME message handling of the Notes client (versions 9 and 10) could potentially be exploited by a
A vulnerability in the input parameter handling of HCL Notes v9 could potentially be exploited by an authenticated attac
Heap-based out-of-bounds write in Samsung Notes prior to version 4.4.21.62 allows local attackers to execute arbitrary c
Path traversal in Samsung Notes prior to version 4.4.21.62 allows local attackers to execute arbitrary code. Rated high
Out-of-bounds write in applying connected information in Samsung Notes prior to version 4.4.21.62 allows local attackers
Out-of-bounds write in appending paragraph in Samsung Notes prior to version 4.4.21.62 allows local attackers to potenti
HCL Notes is susceptible to a stack based buffer overflow vulnerability in lasr.dll in Micro Focus KeyView. Rated high s
HCL Notes is susceptible to a stack based buffer overflow vulnerability in wp6sr.dll in Micro Focus KeyView. Rated high
HCL Notes is susceptible to a stack based buffer overflow vulnerability in lasr.dll in Micro Focus KeyView. Rated high s
A possible buffer overflow vulnerability in maetd_eco_cb_mode of libSPenBase library of Samsung Notes prior to Samsung N
GitHub PoC
Exploit-DB