CVE-2025-20920
Published: 06 March 2025
Summary
CVE-2025-20920 is a medium-severity Out-of-bounds Read (CWE-125) vulnerability in Samsung Notes. Its CVSS base score is 5.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked at the 46.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2025-20920 is an out-of-bounds read vulnerability (CWE-125) in the action link data processing of the Samsung Notes application, affecting versions prior to 4.4.26.71. Published on 2025-03-06, this flaw enables attackers to access memory outside the intended boundaries when handling malformed action link data.
The vulnerability carries a CVSS v3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), indicating it can be exploited by a local attacker with low privileges and low complexity, requiring no user interaction. Successful exploitation allows the attacker to disclose sensitive information from out-of-bounds memory reads, resulting in high confidentiality impact but no impairment to integrity or availability.
Samsung's security advisory for March 2025, accessible at https://security.samsungmobile.com/serviceWeb.smsb?year=2025&month=03, addresses this issue, with mitigation achieved by updating Samsung Notes to version 4.4.26.71 or later.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-6134
Vulnerability details
Out-of-bounds read in action link data in Samsung Notes prior to version 4.4.26.71 allows attackers to read out-of-bounds memory.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The out-of-bounds read vulnerability in Samsung Notes enables local disclosure of sensitive information from memory, directly facilitating data collection from local system sources.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces validation of action link data inputs to reject malformed data that triggers the out-of-bounds read vulnerability.
Implements memory protection safeguards to enforce boundaries and prevent unauthorized out-of-bounds memory access.
Mandates timely flaw remediation by updating Samsung Notes to version 4.4.26.71 or later to eliminate the out-of-bounds read vulnerability.