Bixby
Monthly
Improper input validation in Samsung Bixby before version 4.0.85.6 allows a local attacker who already holds high privileges on the device to launch arbitrary activities, giving a high impact on confidentiality and integrity and a limited impact on availability. Exploitation is strictly local and gated behind pre-existing elevated privileges, with no user interaction required and no remote or unauthenticated path described in the available sources. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and the vendor-reported severity is high (CVSS 8.3) while our assessed CVSS 3.1 vector is 6.5-class local, high-privilege impact; vuln.today prioritizes it as a this-week item rather than an emergency.
Incorrect default permissions in Samsung Bixby prior to version 4.0.86.0 allow a local attacker with low privileges to execute arbitrary commands within the Bixby process context. The flaw exists in the out-of-box permission configuration - no special user-triggered setup is required to be vulnerable. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the local privilege escalation to Bixby's execution context presents meaningful risk for shared-device and enterprise fleet environments.
Improper handling of insufficient permission in Bixby wakeup prior to version 2.3.74.8 allows local attackers to access sensitive data. Rated medium severity (CVSS 6.2), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Improper handling of exceptional conditions in Bixby prior to version 3.0.53.02 allows attacker to execute the actions registered by the user. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper input validation in Samsung Bixby before version 4.0.85.6 allows a local attacker who already holds high privileges on the device to launch arbitrary activities, giving a high impact on confidentiality and integrity and a limited impact on availability. Exploitation is strictly local and gated behind pre-existing elevated privileges, with no user interaction required and no remote or unauthenticated path described in the available sources. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and the vendor-reported severity is high (CVSS 8.3) while our assessed CVSS 3.1 vector is 6.5-class local, high-privilege impact; vuln.today prioritizes it as a this-week item rather than an emergency.
Incorrect default permissions in Samsung Bixby prior to version 4.0.86.0 allow a local attacker with low privileges to execute arbitrary commands within the Bixby process context. The flaw exists in the out-of-box permission configuration - no special user-triggered setup is required to be vulnerable. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the local privilege escalation to Bixby's execution context presents meaningful risk for shared-device and enterprise fleet environments.
Improper handling of insufficient permission in Bixby wakeup prior to version 2.3.74.8 allows local attackers to access sensitive data. Rated medium severity (CVSS 6.2), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Improper handling of exceptional conditions in Bixby prior to version 3.0.53.02 allows attacker to execute the actions registered by the user. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.