CVE-2025-20931
Published: 06 March 2025
Description
Adversaries may exploit software vulnerabilities in client applications to execute code.
Security Summary
CVE-2025-20931 is an out-of-bounds write vulnerability (CWE-787) in the BMP image parsing functionality of the Samsung Notes application, affecting versions prior to 4.4.26.71. Published on 2025-03-06, it carries a CVSS v3.1 base score of 7.3 (AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L), indicating high integrity impact with low confidentiality and availability effects.
Local attackers can exploit this vulnerability by supplying a maliciously crafted BMP image to Samsung Notes. With low attack complexity, no privileges or user interaction required, exploitation enables arbitrary code execution on the local system.
Samsung's security advisory for March 2025, available at https://security.samsungmobile.com/serviceWeb.smsb?year=2025&month=03, addresses the vulnerability and mitigation through updates to Samsung Notes version 4.4.26.71 or later.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Out-of-bounds write in client app (Samsung Notes) BMP parser enables arbitrary code execution on local system with no user interaction required.