CVE-2025-20886

MediumCVSS 4.4/10Last modified Jun 17, 2026

Description

Inclusion of sensitive information in test code in softsim trustlet prior to SMR Jan-2025 Release 1 allows local privileged attackers to get test key.

Metrics

CVSS 3.1 4.4/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-922

Affected software

VendorProductVersions
Samsung MobileSamsung Mobile Devices—

References

Timeline

Published
Feb 4, 2025
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2025

CVE-2025-208875.5Out-of-bounds read in accessing table used for svp8t in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attackers to read arbitrarCVE-2025-208887.8Out-of-bounds write in handling the block size for smp4vtd in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attackers to executeCVE-2025-208895.5Out-of-bounds read in decoding malformed bitstream for smp4vtd in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attackers to reaCVE-2025-20895.4A vulnerability has been found in StarSea99 starsea-mall 1.0/2.X and classified as critical. Affected by this vulnerability is the function CVE-2025-208907.8Out-of-bounds write in decoding frame buffer in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attackers to execute arbitrary codCVE-2025-208915.5Out-of-bounds read in decoding malformed bitstream of video thumbnails in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attackerCVE-2025-208925.9Protection Mechanism Failure in bootloader prior to SMR Jan-2025 Release 1 allows physical attackers to allow to execute fastboot command. UCVE-2025-208935.1Improper access control in NotificationManager prior to SMR Jan-2025 Release 1 allows local attackers to change the configuration of notificCVE-2025-208944.6Improper access control in Samsung Email prior to version 6.1.97.1 allows physical attackers to access data across multiple user profiles.CVE-2025-208954.6Authentication Bypass Using an Alternate Path in Galaxy Store prior to version 4.5.87.6 allows physical attackers to install arbitrary appliCVE-2025-208965.5Use of implicit intent for sensitive communication in EasySetup prior to version 11.1.18 allows local attackers to access sensitive informatCVE-2025-208976.8Improper access control in Secure Folder prior to version 1.9.20.50 in Android 14, 1.8.11.0 in Android 13, and 1.7.04.0 in Android 12 allows
CVE-2025-20886: Medium severity, CVSS 4.4 | Vulnix