CVE-2025-21072 Details
Description
Out-of-bounds write in decoding metadata in fingerprint trustlet prior to SMR Dec-2025 Release 1 allows local privileged attackers to write out-of-bounds memory.
A high-severity out-of-bounds write vulnerability has been identified in the fingerprint trustlet, affecting Samsung devices running Android versions 13, 14, 15, and 16. This vulnerability allows local privileged attackers to write to memory locations outside the intended boundaries, potentially leading to memory corruption.
Users can apply the December 2025 Security Maintenance Release (SMR) to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Dec 3, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=12 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-787 | Out-of-bounds Write | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| samsung android | 13.0 - 13.0 smr-apr-2022-r1 13.0 smr-apr-2023-r1 13.0 smr-apr-2024-r1 13.0 smr-apr-2025-r1 13.0 smr-aug-2022-r1 13.0 smr-aug-2023-r1 13.0 smr-aug-2024-r1 13.0 smr-aug-2025-r1 13.0 smr-dec-2021-r1 13.0 smr-dec-2022-r1 13.0 smr-dec-2023-r1 13.0 smr-dec-2024-r1 13.0 smr-feb-2022-r1 13.0 smr-feb-2023-r1 13.0 smr-feb-2024-r1 13.0 smr-feb-2025-r1 13.0 smr-jan-2022-r1 13.0 smr-jan-2023-r1 13.0 smr-jan-2024-r1 13.0 smr-jan-2025-r1 13.0 smr-jul-2022-r1 13.0 smr-jul-2023-r1 13.0 smr-jul-2024-r1 13.0 smr-jul-2025-r1 13.0 smr-jun-2022-r1 13.0 smr-jun-2023-r1 13.0 smr-jun-2024-r1 13.0 smr-jun-2025-r1 13.0 smr-mar-2022-r1 13.0 smr-mar-2023-r1 13.0 smr-mar-2024-r1 13.0 smr-mar-2025-r1 13.0 smr-may-2022-r1 13.0 smr-may-2023-r1 13.0 smr-may-2024-r1 13.0 smr-may-2025-r1 13.0 smr-nov-2021-r1 13.0 smr-nov-2022-r1 13.0 smr-nov-2023-r1 13.0 smr-nov-2024-r1 13.0 smr-nov-2025-r1 13.0 smr-oct-2022-r1 13.0 smr-oct-2023-r1 13.0 smr-oct-2024-r1 13.0 smr-oct-2025-r1 13.0 smr-sep-2022-r1 13.0 smr-sep-2023-r1 13.0 smr-sep-2024-r1 13.0 smr-sep-2025-r1 14.0 - 14.0 smr-apr-2022-r1 14.0 smr-apr-2023-r1 14.0 smr-apr-2024-r1 14.0 smr-apr-2025-r1 14.0 smr-aug-2022-r1 14.0 smr-aug-2023-r1 14.0 smr-aug-2024-r1 14.0 smr-aug-2025-r1 14.0 smr-dec-2021-r1 14.0 smr-dec-2022-r1 14.0 smr-dec-2023-r1 14.0 smr-dec-2024-r1 14.0 smr-dec-2025-r1 14.0 smr-feb-2022-r1 14.0 smr-feb-2023-r1 14.0 smr-feb-2024-r1 14.0 smr-feb-2025-r1 14.0 smr-jan-2022-r1 14.0 smr-jan-2023-r1 14.0 smr-jan-2024-r1 14.0 smr-jan-2025-r1 14.0 smr-jul-2022-r1 14.0 smr-jul-2023-r1 14.0 smr-jul-2024-r1 14.0 smr-jul-2025-r1 14.0 smr-jun-2022-r1 14.0 smr-jun-2023-r1 14.0 smr-jun-2024-r1 14.0 smr-jun-2025-r1 14.0 smr-mar-2022-r1 14.0 smr-mar-2023-r1 14.0 smr-mar-2024-r1 14.0 smr-mar-2025-r1 14.0 smr-may-2022-r1 14.0 smr-may-2023-r1 14.0 smr-may-2024-r1 14.0 smr-may-2025-r1 14.0 smr-nov-2021-r1 14.0 smr-nov-2022-r1 14.0 smr-nov-2023-r1 14.0 smr-nov-2024-r1 14.0 smr-nov-2025-r1 14.0 smr-oct-2022-r1 14.0 smr-oct-2023-r1 14.0 smr-oct-2024-r1 14.0 smr-oct-2025-r1 14.0 smr-sep-2022-r1 14.0 smr-sep-2023-r1 14.0 smr-sep-2024-r1 14.0 smr-sep-2025-r1 15.0 - 15.0 smr-apr-2025-r1 15.0 smr-aug-2025-r1 15.0 smr-jul-2025-r1 15.0 smr-jun-2025-r1 15.0 smr-mar-2025-r1 15.0 smr-may-2025-r1 15.0 smr-nov-2025-r1 15.0 smr-oct-2025-r1 15.0 smr-sep-2025-r1 16.0 - 16.0 smr-aug-2025-r1 16.0 smr-nov-2025-r1 16.0 smr-oct-2025-r1 16.0 smr-sep-2025-r1 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 26, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Dec 5, 2025 | Initial Analysis | [email protected] |
| Dec 2, 2025 | New CVE Received | [email protected] |