Overview
CVE-2025-21072 is a medium-severity vulnerability affecting Samsung devices. This vulnerability stems from an out-of-bounds write issue within the fingerprint trustlet’s metadata decoding process. A local attacker with elevated privileges could exploit this flaw to overwrite memory beyond the allocated buffer, potentially leading to code execution or denial of service.
Technical Details
The vulnerability lies in the way the fingerprint trustlet handles metadata. Specifically, during the decoding of fingerprint metadata, insufficient bounds checking allows an attacker to craft malicious metadata that can cause a write operation to extend beyond the intended buffer. This out-of-bounds write can corrupt adjacent memory regions, potentially allowing the attacker to gain control of the system. The vulnerability exists prior to the Security Maintenance Release (SMR) of December 2025, Release 1.
CVSS Analysis
The Common Vulnerability Scoring System (CVSS) provides a standardized way to assess the severity of security vulnerabilities. CVE-2025-21072 has been assigned a CVSS score of 5.7 (MEDIUM).
This score reflects the following characteristics:
- Attack Vector (AV): Local (L) – The attacker must have local access to the device.
- Attack Complexity (AC): Low (L) – Exploitation is relatively straightforward.
- Privileges Required (PR): High (H) – The attacker needs elevated privileges to exploit the vulnerability.
- User Interaction (UI): None (N) – No user interaction is required for exploitation.
- Scope (S): Unchanged (U) – The vulnerability impacts only the vulnerable component.
- Confidentiality Impact (C): None (N)
- Integrity Impact (I): High (H)
- Availability Impact (A): None (N)
Possible Impact
The successful exploitation of CVE-2025-21072 can lead to the following potential impacts:
- Code Execution: An attacker could potentially inject and execute arbitrary code with the privileges of the fingerprint trustlet.
- Denial of Service (DoS): The out-of-bounds write can corrupt critical system data, leading to a device crash or instability.
- Data Corruption: Overwriting memory could corrupt sensitive data stored in adjacent memory regions.
Mitigation or Patch Steps
The recommended mitigation for CVE-2025-21072 is to update your Samsung device to the latest firmware version that includes the Security Maintenance Release (SMR) of December 2025, Release 1, or later. This update contains the necessary patch to address the out-of-bounds write vulnerability in the fingerprint trustlet.
- Navigate to your device’s Settings menu.
- Select Software Update or similar (the exact wording may vary depending on your device model and Android version).
- Tap Download and Install to check for and install available updates.
- Ensure your device is running the SMR of December 2025, Release 1 or a later version.
