First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2025-20900

MediumCVSS 4.4/10Last modified Jun 17, 2026

Description

Out-of-bounds write in Blockchain Keystore prior to version 1.3.16.5 allows local privileged attackers to write out-of-bounds memory.

Metrics

CVSS 3.1 4.4/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

Affected software

Vendor	Product	Versions
Samsung Mobile	Blockchain Keystore	—

References

https://security.samsungmobile.com/serviceWeb.smsb?year=2025&month=01Vendor Advisory

Timeline

Published: Feb 4, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-209014.4Out-of-bounds read in Blockchain Keystore prior to version 1.3.16.5 allows local privileged attackers to read out-of-bounds memory.CVE-2025-209025.1Improper access control in Media Controller prior to version 1.0.24.5282 allows local attacker to launch activities in MediaController's pri CVE-2025-209037.3Improper access control in SecSettingsIntelligence prior to SMR Mar-2025 Release 1 allows local attackers to launch privileged activities. U CVE-2025-209046.7Out-of-bounds write in mPOS TUI trustlet prior to SMR Feb-2025 Release 1 allows local privileged attackers to cause memory corruption.CVE-2025-209056.7Out-of-bounds read and write in mPOS TUI trustlet prior to SMR Feb-2025 Release 1 allows local privileged attackers to read and write out-of CVE-2025-209065.5Improper Export of Android Application Components in Settings prior to SMR Feb-2025 Release 1 allows local attackers to enable ADB.CVE-2025-209074.4Improper privilege management in Samsung Find prior to SMR Feb-2025 Release 1 allows local privileged attackers to disable Samsung Find.CVE-2025-209086.5Use of insufficiently random values in Auracast prior to SMR Mar-2025 Release 1 allows adjacent attackers to access Auracast broadcasting.CVE-2025-209095.5Use of implicit intent for sensitive communication in Settings prior to SMR Mar-2025 Release 1 allows local attackers to access sensitive in CVE-2025-20915.4An open redirection vulnerability in M-Files mobile applications for Android and iOS prior to version 25.6.0 allows attackers to use malicio CVE-2025-209106.2Incorrect default permission in Galaxy Watch Gallery prior to SMR Mar-2025 Release 1 allows local attackers to access data in Galaxy Watch G CVE-2025-209114.4Improper access control in sem_wifi service prior to SMR Mar-2025 Release 1 allows privileged local attackers to update MAC address of Galax

CVE-2025-20900: Medium severity, CVSS 4.4 | Vulnix