CVE-2025-20918
Published: 06 March 2025
Summary
CVE-2025-20918 is a medium-severity Out-of-bounds Read (CWE-125) vulnerability in Samsung Notes. Its CVSS base score is 5.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked at the 45.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires timely remediation by updating Samsung Notes to version 4.4.26.71 or later, directly eliminating the out-of-bounds read vulnerability.
Enforces memory protection mechanisms such as bounds checking and address space layout randomization to prevent out-of-bounds reads disclosing sensitive memory.
Validates extra data inputs applied to base content in Samsung Notes to block malformed data triggering the out-of-bounds read.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The out-of-bounds read enables local memory disclosure of application or process data, directly facilitating collection of sensitive information from the local system.
NVD Description
Out-of-bounds read in applying extra data of base content in Samsung Notes prior to version 4.4.26.71 allows attackers to read out-of-bounds memory.
Deeper analysisAI
CVE-2025-20918 is an out-of-bounds read vulnerability (CWE-125) in the Samsung Notes application prior to version 4.4.26.71. The flaw occurs when applying extra data of base content, enabling attackers to read memory outside the intended bounds. It has a CVSS v3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), rated as medium severity due to its local confidentiality impact.
A local attacker with low privileges can exploit this vulnerability without user interaction. By triggering the out-of-bounds read during content processing in Samsung Notes, the attacker can disclose sensitive information from memory, such as application data or potentially other process memory, though it does not allow integrity modification or denial of service.
Samsung's security advisory for March 2025, available at https://security.samsungmobile.com/serviceWeb.smsb?year=2025&month=03, addresses this issue. Mitigation involves updating Samsung Notes to version 4.4.26.71 or later, which resolves the out-of-bounds read in base content handling.
Details
- CWE(s)