Samsung flaws being used in attacks
CISA lists 15 flaws in Samsung products as being used in attacks, most recently on 24 Apr 2026.
SamsungBeing used in attacks
- On CISA’s list
- 15 flaws, added between 8 Nov 2022 and 24 Apr 2026
- Most recent
- CVE-2024-7399, Samsung MagicINFO 9 Server Path Traversal Vulnerability, added 24 Apr 2026
- Used in ransomware
- None known to CISA
- Products
- Mobile Devices (13), MagicINFO 9 Server (2)
What to do
- Update every Samsung product you use.Install the updates Samsung offers, on every device, and restart when asked. Each flaw below has a fix or clear advice; that’s one of CISA’s conditions for listing it.
- If someone looks after IT for you, send them this page.Many of these are in equipment you don’t see: routers, firewalls, servers, the office network. Ask them to confirm each one is fixed, or that you don’t use the product.
- Check anything else in the lookup.Search any app, company or CVE. Not being on CISA’s list doesn’t mean safe: keep updating either way.
Every flaw, newest first
- Samsung MagicINFO 9 Server
CVE-2024-7399Samsung MagicINFO 9 Server Path Traversal VulnerabilitySamsung MagicINFO 9 Server contains a path traversal vulnerability that could allow an attacker to write arbitrary files as system authority.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Samsung Mobile Devices
CVE-2025-21042Samsung Mobile Devices Out-of-Bounds Write VulnerabilitySamsung mobile devices contain an out-of-bounds write vulnerability in libimagecodec.quram.so. This vulnerability could allow remote attackers to execute arbitrary code.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Samsung Mobile Devices
CVE-2025-21043Samsung Mobile Devices Out-of-Bounds Write VulnerabilitySamsung mobile devices contain an out-of-bounds write vulnerability in libimagecodec.quram.so which allows remote attackers to execute arbitrary code.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Samsung MagicINFO 9 Server
CVE-2025-4632Samsung MagicINFO 9 Server Path Traversal VulnerabilitySamsung MagicINFO 9 Server contains a path traversal vulnerability that allows an attacker to write arbitrary file as system authority.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Samsung Mobile Devices
CVE-2022-22265Samsung Mobile Devices Use-After-Free VulnerabilitySamsung devices with selected Exynos chipsets contain a use-after-free vulnerability that allows malicious memory write and code execution.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Samsung Mobile Devices
CVE-2021-25489Samsung Mobile Devices Improper Input Validation VulnerabilitySamsung mobile devices contain an improper input validation vulnerability within the modem interface driver that results in a format string bug leading to kernel panic.CISA’s required actionApply updates per vendor instructions or discontinue use of the product if updates are unavailable - Samsung Mobile Devices
CVE-2021-25487Samsung Mobile Devices Out-of-Bounds Read VulnerabilitySamsung mobile devices contain an out-of-bounds read vulnerability within the modem interface driver due to a lack of boundary checking of a buffer in set_skb_priv(), leading to remote code execution by dereference of an invalid function pointer.CISA’s required actionApply updates per vendor instructions or discontinue use of the product if updates are unavailable - Samsung Mobile Devices
CVE-2021-25395Samsung Mobile Devices Race Condition VulnerabilitySamsung mobile devices contain a race condition vulnerability within the MFC charger driver that leads to a use-after-free allowing for a write given a radio privilege is compromised.CISA’s required actionApply updates per vendor instructions or discontinue use of the product if updates are unavailable - Samsung Mobile Devices
CVE-2021-25394Samsung Mobile Devices Race Condition VulnerabilitySamsung mobile devices contain a race condition vulnerability within the MFC charger driver that leads to a use-after-free allowing for a write given a radio privilege is compromised.CISA’s required actionApply updates per vendor instructions or discontinue use of the product if updates are unavailable - Samsung Mobile Devices
CVE-2021-25372Samsung Mobile Devices Improper Boundary Check VulnerabilitySamsung mobile devices contain an improper boundary check vulnerability within DSP driver that allows for out-of-bounds memory access.CISA’s required actionApply updates per vendor instructions or discontinue use of the product if updates are unavailable - Samsung Mobile Devices
CVE-2021-25371Samsung Mobile Devices Unspecified VulnerabilitySamsung mobile devices contain an unspecified vulnerability within DSP driver that allows attackers to load ELF libraries inside DSP.CISA’s required actionApply updates per vendor instructions or discontinue use of the product if updates are unavailable - Samsung Mobile Devices
CVE-2023-21492Samsung Mobile Devices Insertion of Sensitive Information Into Log File VulnerabilitySamsung mobile devices running Android 11, 12, and 13 contain an insertion of sensitive information into log file vulnerability that allows a privileged, local attacker to conduct an address space layout randomization (ASLR) bypass.CISA’s required actionApply updates per vendor instructions. - Samsung Mobile Devices
CVE-2021-25370Samsung Mobile Devices Memory Corruption VulnerabilitySamsung mobile devices using Mali GPU contain an incorrect implementation handling file descriptor in dpu driver. This incorrect implementation results in memory corruption, leading to kernel panic. This vulnerability was chained with CVE-2021-25337 and CVE-2021-25369.CISA’s required actionApply updates per vendor instructions. - Samsung Mobile Devices
CVE-2021-25369Samsung Mobile Devices Improper Access Control VulnerabilitySamsung mobile devices using Mali GPU contains an improper access control vulnerability in sec_log file. Exploitation of the vulnerability exposes sensitive kernel information to the userspace. This vulnerability was chained with CVE-2021-25337 and CVE-2021-25370.CISA’s required actionApply updates per vendor instructions. - Samsung Mobile Devices
CVE-2021-25337Samsung Mobile Devices Improper Access Control VulnerabilitySamsung mobile devices contain an improper access control vulnerability in clipboard service which allows untrusted applications to read or write arbitrary files. This vulnerability was chained with CVE-2021-25369 and CVE-2021-25370.CISA’s required actionApply updates per vendor instructions.
From CISA’s Known Exploited Vulnerabilities catalog, updated 21 Oct 2026 (version 2026.10.21). CISA’s required actions are written for US government agencies. Samsung on CISA’s site.