CVE-2025-20917
Published: 06 March 2025
Summary
CVE-2025-20917 is a medium-severity Out-of-bounds Read (CWE-125) vulnerability in Samsung Notes. Its CVSS base score is 5.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Credential Access (T1212); ranked at the 45.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents out-of-bounds memory reads by enforcing memory protection techniques such as bounds checking during PDF binary processing in Samsung Notes.
Mandates monitoring for vulnerabilities like CVE-2025-20917 and applying patches such as Samsung Notes version 4.4.26.71 to remediate the flaw.
Validates binary data from PDF content prior to processing to mitigate malformed inputs that trigger the out-of-bounds read in Samsung Notes.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The out-of-bounds read in Samsung Notes enables direct access to sensitive memory contents including user credentials from other processes, which matches the definition of exploiting a software vulnerability to obtain credentials.
NVD Description
Out-of-bounds read in applying binary of pdf content in Samsung Notes prior to version 4.4.26.71 allows attackers to read out-of-bounds memory.
Deeper analysisAI
CVE-2025-20917 is an out-of-bounds read vulnerability (CWE-125) in the Samsung Notes application, affecting versions prior to 4.4.26.71. The flaw occurs when applying binary data from PDF content, enabling attackers to access memory outside intended bounds. It carries a CVSS v3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), rated as medium severity due to its local attack vector and high confidentiality impact.
A local attacker with low privileges on the device can exploit this vulnerability without user interaction or high complexity. Successful exploitation allows reading sensitive out-of-bounds memory, potentially exposing confidential information such as other processes' data or user credentials stored in memory.
Samsung's security advisory at https://security.samsungmobile.com/serviceWeb.smsb?year=2025&month=03 details the issue, with mitigation achieved by updating Samsung Notes to version 4.4.26.71 or later.
Details
- CWE(s)