CVE-2025-21072: Medium severity Samsung Android vulnerability
Published Dec 2, 2025
·Updated
Out-of-bounds write in decoding metadata in fingerprint trustlet prior to SMR Dec-2025 Release 1 allows local privileged attackers to write out-of-bounds memory.
Affected Software
116 affected components
Samsung Android=13.0
Samsung Android=13.0-smr-apr-2022-r1
Samsung Android=13.0-smr-apr-2023-r1
Samsung Android=13.0-smr-apr-2024-r1
Samsung Android=13.0-smr-apr-2025-r1
Samsung Android=13.0-smr-aug-2022-r1
Samsung Android=13.0-smr-aug-2023-r1
Samsung Android=13.0-smr-aug-2024-r1
Samsung Android=13.0-smr-aug-2025-r1
Samsung Android=13.0-smr-dec-2021-r1
Samsung Android=13.0-smr-dec-2022-r1
Samsung Android=13.0-smr-dec-2023-r1
Samsung Android=13.0-smr-dec-2024-r1
Samsung Android=13.0-smr-feb-2022-r1
Samsung Android=13.0-smr-feb-2023-r1
Samsung Android=13.0-smr-feb-2024-r1
Samsung Android=13.0-smr-feb-2025-r1
Samsung Android=13.0-smr-jan-2022-r1
Samsung Android=13.0-smr-jan-2023-r1
Samsung Android=13.0-smr-jan-2024-r1
Samsung Android=13.0-smr-jan-2025-r1
Samsung Android=13.0-smr-jul-2022-r1
Samsung Android=13.0-smr-jul-2023-r1
Samsung Android=13.0-smr-jul-2024-r1
Samsung Android=13.0-smr-jul-2025-r1
Samsung Android=13.0-smr-jun-2022-r1
Samsung Android=13.0-smr-jun-2023-r1
Samsung Android=13.0-smr-jun-2024-r1
Samsung Android=13.0-smr-jun-2025-r1
Samsung Android=13.0-smr-mar-2022-r1
Samsung Android=13.0-smr-mar-2023-r1
Samsung Android=13.0-smr-mar-2024-r1
Samsung Android=13.0-smr-mar-2025-r1
Samsung Android=13.0-smr-may-2022-r1
Samsung Android=13.0-smr-may-2023-r1
Samsung Android=13.0-smr-may-2024-r1
Samsung Android=13.0-smr-may-2025-r1
Samsung Android=13.0-smr-nov-2021-r1
Samsung Android=13.0-smr-nov-2022-r1
Samsung Android=13.0-smr-nov-2023-r1
Samsung Android=13.0-smr-nov-2024-r1
Samsung Android=13.0-smr-nov-2025-r1
Samsung Android=13.0-smr-oct-2022-r1
Samsung Android=13.0-smr-oct-2023-r1
Samsung Android=13.0-smr-oct-2024-r1
Samsung Android=13.0-smr-oct-2025-r1
Samsung Android=13.0-smr-sep-2022-r1
Samsung Android=13.0-smr-sep-2023-r1
Samsung Android=13.0-smr-sep-2024-r1
Samsung Android=13.0-smr-sep-2025-r1
Samsung Android=14.0
Samsung Android=14.0-smr-apr-2022-r1
Samsung Android=14.0-smr-apr-2023-r1
Samsung Android=14.0-smr-apr-2024-r1
Samsung Android=14.0-smr-apr-2025-r1
Samsung Android=14.0-smr-aug-2022-r1
Samsung Android=14.0-smr-aug-2023-r1
Samsung Android=14.0-smr-aug-2024-r1
Samsung Android=14.0-smr-aug-2025-r1
Samsung Android=14.0-smr-dec-2021-r1
Samsung Android=14.0-smr-dec-2022-r1
Samsung Android=14.0-smr-dec-2023-r1
Samsung Android=14.0-smr-dec-2024-r1
Samsung Android=14.0-smr-dec-2025-r1
Samsung Android=14.0-smr-feb-2022-r1
Samsung Android=14.0-smr-feb-2023-r1
Samsung Android=14.0-smr-feb-2024-r1
Samsung Android=14.0-smr-feb-2025-r1
Samsung Android=14.0-smr-jan-2022-r1
Samsung Android=14.0-smr-jan-2023-r1
Samsung Android=14.0-smr-jan-2024-r1
Samsung Android=14.0-smr-jan-2025-r1
Samsung Android=14.0-smr-jul-2022-r1
Samsung Android=14.0-smr-jul-2023-r1
Samsung Android=14.0-smr-jul-2024-r1
Samsung Android=14.0-smr-jul-2025-r1
Samsung Android=14.0-smr-jun-2022-r1
Samsung Android=14.0-smr-jun-2023-r1
Samsung Android=14.0-smr-jun-2024-r1
Samsung Android=14.0-smr-jun-2025-r1
Samsung Android=14.0-smr-mar-2022-r1
Samsung Android=14.0-smr-mar-2023-r1
Samsung Android=14.0-smr-mar-2024-r1
Samsung Android=14.0-smr-mar-2025-r1
Samsung Android=14.0-smr-may-2022-r1
Samsung Android=14.0-smr-may-2023-r1
Samsung Android=14.0-smr-may-2024-r1
Samsung Android=14.0-smr-may-2025-r1
Samsung Android=14.0-smr-nov-2021-r1
Samsung Android=14.0-smr-nov-2022-r1
Samsung Android=14.0-smr-nov-2023-r1
Samsung Android=14.0-smr-nov-2024-r1
Samsung Android=14.0-smr-nov-2025-r1
Samsung Android=14.0-smr-oct-2022-r1
Samsung Android=14.0-smr-oct-2023-r1
Samsung Android=14.0-smr-oct-2024-r1
Samsung Android=14.0-smr-oct-2025-r1
Samsung Android=14.0-smr-sep-2022-r1
Samsung Android=14.0-smr-sep-2023-r1
Samsung Android=14.0-smr-sep-2024-r1
Samsung Android=14.0-smr-sep-2025-r1
Samsung Android=15.0
Samsung Android=15.0-smr-apr-2025-r1
Samsung Android=15.0-smr-aug-2025-r1
Samsung Android=15.0-smr-jul-2025-r1
Samsung Android=15.0-smr-jun-2025-r1
Samsung Android=15.0-smr-mar-2025-r1
Samsung Android=15.0-smr-may-2025-r1
Samsung Android=15.0-smr-nov-2025-r1
Samsung Android=15.0-smr-oct-2025-r1
Samsung Android=15.0-smr-sep-2025-r1
Samsung Android=16.0
Samsung Android=16.0-smr-aug-2025-r1
Samsung Android=16.0-smr-nov-2025-r1
Samsung Android=16.0-smr-oct-2025-r1
Samsung Android=16.0-smr-sep-2025-r1
Event History
Dec 2, 2025
CVE Published
via MITRE·01:23 AM
Data Sourced
via MITRE·01:23 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·02:15 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-21072?
CVE-2025-21072 has a high severity rating due to the potential for local privileged attackers to exploit the out-of-bounds write vulnerability.
2
How do I fix CVE-2025-21072?
To fix CVE-2025-21072, update your Samsung Android device to the latest firmware version that addresses this vulnerability.
3
Which devices are affected by CVE-2025-21072?
CVE-2025-21072 affects various Samsung Android devices running versions 13.0 and 14.0, including specific security maintenance releases.
4
What type of vulnerability is CVE-2025-21072?
CVE-2025-21072 is categorized as an out-of-bounds write vulnerability affecting fingerprint trustlets.
5
Can CVE-2025-21072 be exploited remotely?
No, CVE-2025-21072 requires local access, meaning an attacker must have physical access to the device to exploit the vulnerability.