Samsung · Mobile Devices
CVE-2021-25487
Samsung Mobile Devices Out-of-Bounds Read Vulnerability
What it is
Lack of boundary checking of a buffer in set_skb_priv() of modem interface driver prior to SMR Oct-2021 Release 1 allows OOB read and it results in arbitrary code execution by dereference of invalid function pointer.
CISA: Samsung mobile devices contain an out-of-bounds read vulnerability within the modem interface driver due to a lack of boundary checking of a buffer in set_skb_priv(), leading to remote code execution by dereference of an invalid function pointer.
What to do
Apply updates per vendor instructions or discontinue use of the product if updates are unavailable
Deadline for US federal agencies: July 20, 2023
More exploited flaws from Samsung
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Nov 10, 2025 | Out-of-Bounds Write | Mobile Devices | High 8.8 | 36% |
| Oct 2, 2025 | Out-of-Bounds Write | Mobile Devices | High 8.8 | 2.2% |
| Sep 18, 2023 | Use-After-Free | Mobile Devices | Medium 5.0 | 0.4% |
| Jun 29, 2023 | Unspecified | Mobile Devices | Medium 6.1 | 0.8% |
| Jun 29, 2023 | Improper Boundary Check | Mobile Devices | Medium 6.1 | 0.8% |
| Jun 29, 2023 | Race Condition | Mobile Devices | Medium 6.4 | 0.4% |
| Jun 29, 2023 | Race Condition | Mobile Devices | Medium 6.4 | 0.4% |
| Jun 29, 2023 | Improper Input Validation | Mobile Devices | Low 3.3 | 0.5% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.