CVE-2021-25372

CVE-2021-25372 is an improper boundary check in the DSP (Digital Signal Processor) driver on Samsung mobile devices, which allows an out-of-bounds memory access when processing malformed inputs. The flaw is triggered locally on affected Samsung devices running a security patch level older than the March 2021 Samsung Maintenance Release (SMR Mar-2021 Release 1). A successful exploit yields high impact to confidentiality, integrity, and availability on the device (memory corruption class bug, CWE-787), and given its local attack vector it is most plausibly used as a step in a broader exploit chain rather than a remote, standalone attack. All Samsung Android smartphones and tablets that have not received the March 2021 (or later) security update are affected. The vulnerability was added to CISA's Known Exploited Vulnerabilities catalog on 2023-06-29, confirming it is being actively exploited in the wild, though details of specific ransomware or campaign use are unknown.

What to do: Update affected Samsung devices to the SMR Mar-2021 Release 1 security patch (Android security patch level 2021-03-01) or any later monthly release, per Samsung's instructions; this is the required action listed in CISA's KEV catalog. Fleet managers should check device patch levels via Settings > About phone > Software information > Android security patch version and treat any device below 2021-03-01 as vulnerable. Because the bug is locally exploitable and actively exploited, prioritize patching devices used by high-risk users and verify no exploit chain relyed on unpatched DSP drivers.