Samsung Notes CVE-2025-21070

Exploitation requires local access to the device and a low-privileged context (PR:L) - typically a separate malicious or compromised app - able to supply a crafted SPI-format file to Samsung Notes' SPI decoder, which is the exact feature that performs the out-of-bounds write. There is no user interaction requirement (UI:N), but the local attack vector (AV:L) means remote or network exploitation is not possible; the attacker must already be present on the device. Limiting factors: the affected version must be prior to 4.4.30.63, impact is confined to integrity (no data disclosure or crash guaranteed), and no public exploit exists to lower the development barrier.

This is a moderate, low-priority issue rather than an urgent one, and the signals are internally consistent. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, base 5.5) describes a locally exploitable out-of-bounds write requiring low privileges, with impact limited to integrity (no confidentiality or availability loss). EPSS reinforces low real-world urgency at 0.12% (2nd percentile), and the CVE is not listed in CISA KEV, so there is no public exploit identified at time of analysis. No SSVC decision data was provided. The local attack vector (AV:L) is the dominant limiting factor: an attacker already needs code execution or an app presence on the Samsung device to reach the vulnerable SPI decoder, which sharply narrows the realistic threat to chained post-compromise scenarios or a malicious sideloaded app. The integrity-only impact (I:H, C:N/A:N) suggests memory corruption that could potentially be leveraged toward code execution within the app's context, but the CVSS scoring does not claim confidentiality or availability loss, so the advisory treats it as a contained write primitive. No conflicting signals were found between the CVSS vector and the description - both agree on local access.

A malicious or compromised app on a Samsung device, running with low privileges, delivers a crafted SPI-format file to Samsung Notes; when the SPI decoder parses it, the out-of-bounds write corrupts adjacent memory, potentially enabling an integrity violation or follow-on code execution within the Notes app context. No public exploit code was identified at time of analysis, so any attack would require the adversary to develop their own exploit. Because the vector is local (AV:L) with no user interaction (UI:N), exploitation hinges on already having a foothold or a running app on the device.