CVE-2021-25487VulnerabilityPublished 06/29/2023Updated 10/24/2026
CVE-2021-25487: Samsung Mobile Devices Out-of-Bounds Read Vulnerability
Affects Samsung Mobile DevicesSource CISA KEV
Severity
HighNo CVSS score published yet
- Exploitation
Actively exploited – in CISA KEV since 06/29/2023
- KEV deadline
- 07/20/2023
- EPSS
- 0.6% chance of exploitation in 30 days – higher than 49% of CVEs
What to do
CISA required action
Apply updates per vendor instructions or discontinue use of the product if updates are unavailable
Description
Samsung mobile devices contain an out-of-bounds read vulnerability within the modem interface driver due to a lack of boundary checking of a buffer in set_skb_priv(), leading to remote code execution by dereference of an invalid function pointer.