CVE-2021-25408

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A possible buffer overflow vulnerability in NPU driver prior to SMR JUN-2021 Release 1 allows arbitrary memory write and code execution.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787CWE-120

Affected software

VendorProductVersions
Samsung MobileSamsung Mobile Devices>= P(9.0), Q(10.0), R(11.0) devices with Exynos9820, 9830, 980, 2100 chipsets, < SMR JUN-2021 Release 1

References

Timeline

Published
Jun 11, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-254092.4Improper access in Notification setting prior to SMR JUN-2021 Release 1 allows physically proximate attackers to set arbitrary notification CVE-2021-254107.1Improper access control of a component in CallBGProvider prior to SMR JUN-2021 Release 1 allows local attackers to access arbitrary files wiCVE-2021-254114.4Improper address validation vulnerability in RKP api prior to SMR JUN-2021 Release 1 allows root privileged local attackers to write read-onCVE-2021-254127.8An improper access control vulnerability in genericssoservice prior to SMR JUN-2021 Release 1 allows local attackers to execute protected acCVE-2021-254135.5Improper sanitization of incoming intent in Samsung Contacts prior to SMR JUN-2021 Release 1 allows local attackers to get permissions to acCVE-2021-254147.8Improper sanitization of incoming intent in Samsung Contacts prior to SMR JUN-2021 Release 1 allows local attackers to copy or overwrite arbCVE-2021-254155.5Assuming EL1 is compromised, an improper address validation in RKP prior to SMR JUN-2021 Release 1 allows local attackers to remap EL2 memorCVE-2021-254166.5Assuming EL1 is compromised, an improper address validation in RKP prior to SMR JUN-2021 Release 1 allows local attackers to create executabCVE-2021-254177.5Improper authorization in SDP SDK prior to SMR JUN-2021 Release 1 allows access to internal storage.CVE-2021-254187.8Improper component protection vulnerability in Samsung Internet prior to version 14.0.1.62 allows untrusted applications to execute arbitrarCVE-2021-254196.5Non-compliance of recommended secure coding scheme in Samsung Internet prior to version 14.0.1.62 allows attackers to display fake URL in adCVE-2021-254205.5Improper log management vulnerability in Galaxy Watch PlugIn prior to version 2.2.05.21033151 allows attacker with log permissions to leak W
CVE-2021-25408: High severity, CVSS 7.8 | Vulnix