CVE-2021-25346

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A possible arbitrary memory overwrite vulnerabilities in quram library version prior to SMR Jan-2021 Release 1 allow arbitrary code execution.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
Samsung Mobile	Samsung Mobile Devices	>= O(8.x), P(9.0), Q(10.0), < SMR Jan-2021 Release 1

References

https://security.samsungmobile.com/Vendor Advisory
https://security.samsungmobile.com/securityUpdate.smsbVendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-21-342/Third Party Advisory, VDB Entry
https://security.samsungmobile.com/Vendor Advisory
https://security.samsungmobile.com/securityUpdate.smsbVendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-21-342/Third Party Advisory, VDB Entry

Timeline

Published: Mar 4, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-253475.3Hijacking vulnerability in Samsung Email application version prior to SMR Feb-2021 Release 1 allows attackers to intercept when the provider CVE-2021-253482.4Improper permission grant check in Samsung Internet prior to version 13.0.1.60 allows access to files in internal storage without authorized CVE-2021-253497.8Using unsafe PendingIntent in Slow Motion Editor prior to version 3.5.18.5 allows local attackers unauthorized action without permission via CVE-2021-253503.9Information Exposure vulnerability in Samsung Account prior to version 12.1.1.3 allows physically proximate attackers to access user informa CVE-2021-253512.4Improper Access Control in EmailValidationView in Samsung Account prior to version 10.7.0.7 and 12.1.1.3 allows physically proximate attacke CVE-2021-253527.8Using PendingIntent with implicit intent in Bixby Voice prior to version 3.0.52.14 allows attackers to execute privileged action by hijackin CVE-2021-253537.1Using empty PendingIntent in Galaxy Themes prior to version 5.2.00.1215 allows local attackers to read/write private file directories of Gal CVE-2021-253545.3Improper input check in Samsung Internet prior to version 13.2.1.46 allows attackers to launch non-exported activity in Samsung Browser via CVE-2021-253557.8Using unsafe PendingIntent in Samsung Notes prior to version 4.2.00.22 allows local attackers unauthorized action without permission via hij CVE-2021-253568.8An improper caller check vulnerability in Managed Provisioning prior to SMR APR-2021 Release 1 allows unprivileged application to install ar CVE-2021-253575.5A pendingIntent hijacking vulnerability in Create Movie prior to SMR APR-2021 Release 1 in Android O(8.x) and P(9.0), 3.4.81.1 in Android Q(CVE-2021-253583.3A vulnerability that stores IMSI values in an improper path prior to SMR APR-2021 Release 1 allows local attackers to access IMSI values wit