ACTIVELY EXPLOITED
CVE-2021-25370: Samsung Mobile Devices Memory Corruption Vulnerability
| Vendor | Samsung |
|---|---|
| Product | Mobile Devices |
| Actively exploited | Yes |
| Added to CISA KEV | 8 Nov 2022 |
| CISA federal deadline | 29 Nov 2022 |
| Weakness (CWE) | CWE-416 |
Required action (CISA's text)
Apply updates per vendor instructions.
Description (NVD)
Samsung mobile devices using Mali GPU contain an incorrect implementation handling file descriptor in dpu driver. This incorrect implementation results in memory corruption, leading to kernel panic. This vulnerability was chained with CVE-2021-25337 and CVE-2021-25369.
SOURCES
Other Samsung flaws
- CVE-2024-7399: Samsung MagicINFO 9 Server Path Traversal Vulnerability
- CVE-2025-21042: Samsung Mobile Devices Out-of-Bounds Write Vulnerability
- CVE-2025-21043: Samsung Mobile Devices Out-of-Bounds Write Vulnerability
- CVE-2025-4632: Samsung MagicINFO 9 Server Path Traversal Vulnerability
- CVE-2022-22265: Samsung Mobile Devices Use-After-Free Vulnerability
Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 10 Nov 2026.