Samsung Notes
CVE-2025-21069
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local access or install malicious app
-
ExploitDeliver crafted image to Samsung Notes
-
ExecutionTrigger out-of-bounds read in image parser
-
ImpactLeak adjacent memory or crash app
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires LOCAL access to a device running Samsung Notes prior to version 4.4.30.63, plus the ability to get the app to parse attacker-controlled image data (e.g. a crafted image embedded in or imported into a note). Limiting factors: the attack vector is local (AV:L) not network, so no remote exploitation is possible; it needs at least low privileges (PR:L), such as a malicious/co-located app or local file delivery; and realistically the targeted image must be opened/rendered by the app. It affects the Samsung Notes app specifically, so non-Samsung or patched (>=4.4.30.63) devices are not exposed. |
| Impact | This is a vendor-reported (mobile.security@samsung.com) out-of-bounds read (CWE-125) in Samsung Notes image-data parsing. The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H, 7.1 HIGH) describes a LOCAL attack vector requiring low privileges and no user interaction, which is consistent with a malicious app or local actor supplying crafted image data that the Notes app parses on-device. There is NO EPSS score, NO CISA KEV listing, and NO public POC provided - so there is no public exploit identified at time of analysis and no evidence of active exploitation. Two points warrant scrutiny: (1) an out-of-bounds READ most naturally yields information disclosure (C), while the vector's A:H (high availability impact) is plausible only if the read reliably crashes the app - this is defensible as a DoS but on the high side for a pure read; (2) UI:N combined with image parsing is slightly optimistic, since in practice a victim typically must open a crafted note/image, implying some user interaction. Net: this is a real, vendor-confirmed memory-safety defect but a locally-scoped, lower-urgency issue - not a remotely-exploitable emergency. CVSS 7.1 overstates real-world priority given AV:L, no KEV, and no POC. |
| Exploit ScenarioDerived | A local attacker - for example a malicious or compromised app with low privileges, or a crafted image file delivered to the device - induces Samsung Notes to parse malformed image data, triggering an out-of-bounds read that leaks adjacent process memory (potentially tokens, note contents, or pointers) and/or crashes the application. No public exploit code is available, and exploitation requires local access to the device rather than a network path. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 01, 2026
Out-of-bounds memory disclosure in Samsung Notes prior to 4.4.30.63 allows local attackers with low privileges to read beyond allocated buffers when parsing crafted images, potentially leaking sensitive data. The attack requires user interaction to open the malicious image, and while it has high confidentiality impact, availability impact is low. This vendor-reported issue (mobile.security@samsung.com) has no public exploit code or active exploitation identified at time of analysis.
RemediationAI
Apply the vendor patch by updating Samsung Notes to version 4.4.30.63 or later. The update is available through the Samsung Galaxy Store or Google Play Store. Refer to the vendor advisory at https://security.samsungmobile.com/serviceWeb.smsb?year=2025&month=10 for details. As a workaround if immediate patching is not possible, users should avoid opening or importing images from untrusted sources into Samsung Notes, and restrict the ability of untrusted apps to share images with Samsung Notes. However, these workarounds are not fully effective because the user interaction of opening a crafted image is the primary exploit vector. No other compensating controls are known. Patching is strongly recommended.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is an out-of-bounds read (CWE-125) in the image parsing component of Samsung Notes, a note-taking application. The CPE entry cpe:2.3:a:samsung:notes:*:*:*:*:*:*:*:* indicates that all versions of Samsung Notes before 4.4.30.63 are affected. CWE-125 occurs when software reads data past the end of an allocated buffer, which can result in the disclosure of sensitive information from adjacent memory. In this case, malformed image data parsed by the app triggers the out-of-bounds read. The attack is local (AV:L) and requires low privileges (PR:L) plus user interaction (UI:R) to process the crafted image, as confirmed by the independent assessment. The specific image parsing routine or library is not identified, but the issue lies in how the app handles image data, likely during import or rendering of notes with embedded images. No remote exploitation is possible given the local attack vector.
Know when Notes gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Local app-parsing bug (AV:L, PR:L) realistically needs the victim to open crafted image data (UI:R); OOB read primarily discloses memory (C:H) with at most a crash (A:L), no integrity impact.
Primary rating from NVD.
CVSS VectorNVD
DescriptionNVD
Out-of-bounds read in the parsing of image data in Samsung Notes prior to version 4.4.30.63 allows local attackers to access out-of-bounds memory.
Executive ViewAI
Samsung Notes versions prior to 4.4.30.63 contain a memory disclosure flaw that can expose sensitive data from a device to a local attacker who convinces a user to open a crafted image. While the issue requires local access and user interaction, leaked content could include confidential notes, credentials, or corporate information stored on managed mobile devices. Leadership should care because this affects mobile endpoints used for business communications, and no vendor patch is currently available, requiring interim risk reduction.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict or disable Samsung Notes on high-sensitivity devices, block opening of images from untrusted sources via user guidance and MDM policy, apply mobile DLP and least-privilege controls to limit local access, and monitor for anomalous local data access until a fixed version is available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Affected Products (CPE)NVD
Stack-based out-of-bounds write in Samsung Notes prior to version 4.4.21.62 allows remote attackers to execute arbitrary
A vulnerability in the MIME message handling of the HCL Notes v9 client could potentially be exploited by an unauthentic
A vulnerability in the MIME message handling of the Notes client (versions 9 and 10) could potentially be exploited by a
A vulnerability in the input parameter handling of HCL Notes v9 could potentially be exploited by an authenticated attac
Heap-based out-of-bounds write in Samsung Notes prior to version 4.4.21.62 allows local attackers to execute arbitrary c
Path traversal in Samsung Notes prior to version 4.4.21.62 allows local attackers to execute arbitrary code. Rated high
Out-of-bounds write in applying connected information in Samsung Notes prior to version 4.4.21.62 allows local attackers
Out-of-bounds write in appending paragraph in Samsung Notes prior to version 4.4.21.62 allows local attackers to potenti
HCL Notes is susceptible to a stack based buffer overflow vulnerability in lasr.dll in Micro Focus KeyView. Rated high s
HCL Notes is susceptible to a stack based buffer overflow vulnerability in wp6sr.dll in Micro Focus KeyView. Rated high
HCL Notes is susceptible to a stack based buffer overflow vulnerability in lasr.dll in Micro Focus KeyView. Rated high s
A possible buffer overflow vulnerability in maetd_eco_cb_mode of libSPenBase library of Samsung Notes prior to Samsung N
GitHub PoC
Exploit-DB