CVE-2025-21054

MediumCVSS 5.5/10Last modified Oct 8, 2026

Description

Out-of-bounds read in the parsing header for JPEG decoding in libpadm.so prior to SMR Oct-2025 Release 1 allows local attackers to potentially access out-of-bounds memory.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-125

Affected software

No affected versions have been published.

Timeline

Published: Oct 10, 2025
Last modified: Oct 8, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-210557.5Out-of-bounds read and write in libimagecodec.quram.so prior to SMR Oct-2025 Release 1 allows remote attackers to access out-of-bounds memor CVE-2025-210566.6Improper input validation in Retail Mode prior to version 5.59.4 allows self attackers to execute privileged commands on their own devices.CVE-2025-210573.3Use of implicit intent for sensitive communication in Samsung Notes prior to version 4.4.30.63 allows local attackers to access shared notes CVE-2025-210587.3Improper access control in Routines prior to version 4.8.7.1 in Android 15 and 4.9.6.0 in Android 16 allows local attackers to potentially e CVE-2025-210595.5Improper authorization in Samsung Health prior to version 6.30.5.105 allows local attackers to access data in Samsung Health.CVE-2025-21067.5The ArielBrailovsky-ViralAd plugin for WordPress is vulnerable to SQL Injection via the 'text' and 'id' parameters of the limpia() function CVE-2025-210605.5Cleartext storage of sensitive information in Smart Switch prior to version 3.7.67.2 allows local attackers to access backup data from appli CVE-2025-210615.5Cleartext storage of sensitive information in Smart Switch prior to version 3.7.67.2 allows local attackers to access sensitive data. User i CVE-2025-210627.8Use of a broken or risky cryptographic algorithm in Smart Switch prior to version 3.7.67.2 allows local attackers to replace the restoring a CVE-2025-210634.6Improper access control in Samsung Voice Recorder prior to version 21.5.73.12 in Android 15 and 21.5.81.40 in Android 16 allows physical att CVE-2025-210646.5Improper authentication in Smart Switch prior to version 3.7.66.6 allows adjacent attackers to access transferring data.CVE-2025-210656.6Improper input validation in Retail Mode prior to version 5.59.11 allows self attackers to execute privileged commands on their own devices.