CVE-2021-25498

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A possible buffer overflow vulnerability in maetd_eco_cb_mode of libSPenBase library of Samsung Notes prior to Samsung Notes version 4.3.02.61 allows arbitrary code execution.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-120

Affected software

Vendor	Product	Versions
Samsung Mobile	Samsung Notes	>= -, < 4.3.02.61

References

https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=10Vendor Advisory
https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=10Vendor Advisory

Timeline

Published: Oct 6, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-254995.5Intent redirection vulnerability in SamsungAccountSDKSigninActivity of Galaxy Store prior to version 4.5.32.4 allows attacker to access cont CVE-2021-255004.4A missing input validation in HDCP LDFW prior to SMR Nov-2021 Release 1 allows attackers to overwrite TZASC allowing TEE compromise.CVE-2021-255013.3An improper access control vulnerability in SCloudBnRReceiver in SecTelephonyProvider prior to SMR Nov-2021 Release 1 allows untrusted appli CVE-2021-255025.5A vulnerability of storing sensitive information insecurely in Property Settings prior to SMR Nov-2021 Release 1 allows attackers to read ES CVE-2021-255036.7Improper input validation vulnerability in HDCP prior to SMR Nov-2021 Release 1 allows attackers to arbitrary code execution.CVE-2021-255044.0Intent redirection vulnerability in Group Sharing prior to 10.8.03.2 allows attacker to access contact information.CVE-2021-255057.8Improper authentication in Samsung Pass prior to 3.0.02.4 allows to use app without authentication when lockscreen is unlocked.CVE-2021-255065.5Non-existent provider in Samsung Health prior to 6.19.1.0001 allows attacker to access it via malicious content provider or lead to denial o CVE-2021-255075.7Improper authorization vulnerability in Samsung Flow mobile application prior to 4.8.03.5 allows Samsung Flow PC application connected with CVE-2021-255089.8Improper privilege management vulnerability in API Key used in SmartThings prior to 1.7.73.22 allows an attacker to abuse the API key withou CVE-2021-255097.1A missing input validation in Samsung Flow Windows application prior to Version 4.8.5.0 allows attackers to overwrite abtraty file in the Wi CVE-2021-255107.8An improper validation vulnerability in FilterProvider prior to SMR Dec-2021 Release 1 allows local arbitrary code execution.