CVE-2025-20904 Details
Description
Out-of-bounds write in mPOS TUI trustlet prior to SMR Feb-2025 Release 1 allows local privileged attackers to cause memory corruption.
A high-severity out-of-bounds write vulnerability has been identified in the mPOS TUI trustlet, affecting Samsung Mobile devices running Android 12, 13, or 14 with Qualcomm chipsets, prior to the February 2025 Security Maintenance Release. This vulnerability allows local privileged attackers to cause memory corruption. The issue was privately disclosed on November 7, 2024.
Samsung Mobile has released a patch for this vulnerability as part of the February 2025 Security Maintenance Release. Users can update their devices to this version to address the vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Feb 4, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=02 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-787 | Out-of-bounds Write | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| samsung android | 12.0 - 12.0 smr-apr-2022-r1 12.0 smr-apr-2023-r1 12.0 smr-apr-2024-r1 12.0 smr-aug-2022-r1 12.0 smr-aug-2023-r1 12.0 smr-aug-2024-r1 12.0 smr-dec-2021-r1 12.0 smr-dec-2022-r1 12.0 smr-dec-2023-r1 12.0 smr-dec-2024-r1 12.0 smr-feb-2022-r1 12.0 smr-feb-2023-r1 12.0 smr-feb-2024-r1 12.0 smr-jan-2022-r1 12.0 smr-jan-2023-r1 12.0 smr-jan-2024-r1 12.0 smr-jan-2025-r1 12.0 smr-jul-2022-r1 12.0 smr-jul-2023-r1 12.0 smr-jul-2024-r1 12.0 smr-jun-2022-r1 12.0 smr-jun-2023-r1 12.0 smr-jun-2024-r1 12.0 smr-mar-2022-r1 12.0 smr-mar-2023-r1 12.0 smr-mar-2024-r1 12.0 smr-may-2022-r1 12.0 smr-may-2023-r1 12.0 smr-may-2024-r1 12.0 smr-nov-2021-r1 12.0 smr-nov-2022-r1 12.0 smr-nov-2023-r1 12.0 smr-nov-2024-r1 12.0 smr-oct-2022-r1 12.0 smr-oct-2023-r1 12.0 smr-oct-2024-r1 12.0 smr-sep-2022-r1 12.0 smr-sep-2023-r1 12.0 smr_sep-2024-r1 13.0 - 13.0 smr-apr-2022-r1 13.0 smr-apr-2023-r1 13.0 smr-apr-2024-r1 13.0 smr-aug-2022-r1 13.0 smr-aug-2023-r1 13.0 smr-aug-2024-r1 13.0 smr-dec-2021-r1 13.0 smr-dec-2022-r1 13.0 smr-dec-2023-r1 13.0 smr-dec-2024-r1 13.0 smr-feb-2022-r1 13.0 smr-feb-2023-r1 13.0 smr-feb-2024-r1 13.0 smr-jan-2022-r1 13.0 smr-jan-2023-r1 13.0 smr-jan-2024-r1 13.0 smr-jan-2025-r1 13.0 smr-jul-2022-r1 13.0 smr-jul-2023-r1 13.0 smr-jul-2024-r1 13.0 smr-jun-2022-r1 13.0 smr-jun-2023-r1 13.0 smr-jun-2024-r1 13.0 smr-mar-2022-r1 13.0 smr-mar-2023-r1 13.0 smr-mar-2024-r1 13.0 smr-may-2022-r1 13.0 smr-may-2023-r1 13.0 smr-may-2024-r1 13.0 smr-nov-2021-r1 13.0 smr-nov-2022-r1 13.0 smr-nov-2023-r1 13.0 smr-nov-2024-r1 13.0 smr-oct-2022-r1 13.0 smr-oct-2023-r1 13.0 smr-oct-2024-r1 13.0 smr-sep-2022-r1 13.0 smr-sep-2023-r1 13.0 smr-sep-2024-r1 14.0 - 14.0 smr-apr-2022-r1 14.0 smr-apr-2023-r1 14.0 smr-apr-2024-r1 14.0 smr-aug-2022-r1 14.0 smr-aug-2023-r1 14.0 smr-aug-2024-r1 14.0 smr-dec-2021-r1 14.0 smr-dec-2022-r1 14.0 smr-dec-2023-r1 14.0 smr-dec-2024-r1 14.0 smr-feb-2022-r1 14.0 smr-feb-2023-r1 14.0 smr-feb-2024-r1 14.0 smr-jan-2022-r1 14.0 smr-jan-2023-r1 14.0 smr-jan-2024-r1 14.0 smr-jan-2025-r1 14.0 smr-jul-2022-r1 14.0 smr-jul-2023-r1 14.0 smr-jul-2024-r1 14.0 smr-jun-2022-r1 14.0 smr-jun-2023-r1 14.0 smr-jun-2024-r1 14.0 smr-mar-2022-r1 14.0 smr-mar-2023-r1 14.0 smr-mar-2024-r1 14.0 smr-may-2022-r1 14.0 smr-may-2023-r1 14.0 smr-may-2024-r1 14.0 smr-nov-2021-r1 14.0 smr-nov-2022-r1 14.0 smr-nov-2023-r1 14.0 smr-nov-2024-r1 14.0 smr-oct-2022-r1 14.0 smr-oct-2023-r1 14.0 smr-oct-2024-r1 14.0 smr-sep-2022-r1 14.0 smr-sep-2023-r1 14.0 smr-sep-2024-r1 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Feb 12, 2025 | Initial Analysis | [email protected] |
| Feb 4, 2025 | New CVE Received | [email protected] |