CVE-2025-20889

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

Out-of-bounds read in decoding malformed bitstream for smp4vtd in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attackers to read arbitrary memory. User interaction is required for triggering this vulnerability.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
Samsung Mobile	Samsung Mobile Devices	—

References

https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=01Vendor Advisory

Timeline

Published: Feb 4, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-20895.4A vulnerability has been found in StarSea99 starsea-mall 1.0/2.X and classified as critical. Affected by this vulnerability is the function CVE-2025-208907.8Out-of-bounds write in decoding frame buffer in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attackers to execute arbitrary cod CVE-2025-208915.5Out-of-bounds read in decoding malformed bitstream of video thumbnails in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attacker CVE-2025-208925.9Protection Mechanism Failure in bootloader prior to SMR Jan-2025 Release 1 allows physical attackers to allow to execute fastboot command. U CVE-2025-208935.1Improper access control in NotificationManager prior to SMR Jan-2025 Release 1 allows local attackers to change the configuration of notific CVE-2025-208944.6Improper access control in Samsung Email prior to version 6.1.97.1 allows physical attackers to access data across multiple user profiles.CVE-2025-208954.6Authentication Bypass Using an Alternate Path in Galaxy Store prior to version 4.5.87.6 allows physical attackers to install arbitrary appli CVE-2025-208965.5Use of implicit intent for sensitive communication in EasySetup prior to version 11.1.18 allows local attackers to access sensitive informat CVE-2025-208976.8Improper access control in Secure Folder prior to version 1.9.20.50 in Android 14, 1.8.11.0 in Android 13, and 1.7.04.0 in Android 12 allows CVE-2025-208984.6Improper input validation in Samsung Members prior to version 5.2.00.12 allows physical attackers to access data across multiple user profil CVE-2025-208994.0Improper access control in PushNotification prior to version 13.0.00.15 in Android 12, 14.0.00.7 in Android 13, and 15.1.00.5 in Android 14 CVE-2025-20904.7A vulnerability was found in PHPGurukul Pre-School Enrollment System 1.0 and classified as critical. Affected by this issue is some unknown