CVE-2025-20974

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Improper handling of insufficient permission in PackageInstallerCN prior to version 15.0.11.0 allows local attacker to bypass user interaction for requested installation.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Affected software

Vendor	Product	Versions
Samsung Mobile	PackageInstallerCN	—

References

https://security.samsungmobile.com/serviceWeb.smsb?year=2025&month=05

Timeline

Published: May 7, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-209755.5Improper Export of Android Application Components in AODService prior to version 8.8.28.12 allows local attackers to launch arbitrary activi CVE-2025-209767.5Out-of-bounds read in applying binary of text content in Samsung Notes prior to version 4.4.29.23 allows attackers to read out-of-bounds mem CVE-2025-209773.3Use of implicit intent for sensitive communication in translation in Samsung Notes prior to version 4.4.29.23 allows local attackers to get CVE-2025-209786.2Improper access control in PENUP prior to version 3.9.19.32 allows local attackers to access files with PENUP privilege.CVE-2025-209797.8Out-of-bounds write in libsavscmn prior to Android 15 allows local attackers to execute arbitrary code.CVE-2025-20988.4Fast CAD Reader application on MacOS was found to be installed with incorrect file permissions (rwxrwxrwx). This is inconsistent with standa CVE-2025-209805.5Out-of-bounds write in libsavscmn prior to Android 15 allows local attackers to cause memory corruption.CVE-2025-209816.2Improper access control in AudioService prior to SMR Jun-2025 Release 1 allows local attackers to access sensitive information.CVE-2025-209826.7Out-of-bounds write in setting auth secret in KnoxVault trustlet prior to SMR Jul-2025 Release 1 allows local privileged attackers to write CVE-2025-209836.7Out-of-bounds write in checking auth secret in KnoxVault trustlet prior to SMR Jul-2025 Release 1 allows local privileged attackers to write CVE-2025-209846.2Incorrect default permission in Samsung Cloud for Galaxy Watch prior to SMR Jun-2025 Release 1 allows local attackers to access data in Sams CVE-2025-209853.3Improper privilege management in ThemeManager prior to SMR Jun-2025 Release 1 allows local privileged attackers to reuse trial items.