Samsung Notes vulnerabilities

64 CVEs affecting Samsung Notes, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-21107, published 2026-09-09.

More from Samsung.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2024-34657, published 2024-09-04. Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days. Stack-based out-of-bounds write in Samsung Notes prior to version 4.4.21.62 allows remote attackers to execute arbitrary code.
• CVE-2021-25367, published 2021-03-25. Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days. Path Traversal vulnerability in Samsung Notes prior to version 4.2.00.22 allows attackers to access local files without permission.
• CVE-2018-10501, published 2018-09-24. High severity, CVSS 7.0. EPSS: 0.3% chance of exploitation in the next 30 days. This vulnerability allows local attackers to escalate privileges on vulnerable installations of Samsung Notes Fixed in version 2.0.02.31. An attacker must first obtain the ability to execute…
• CVE-2021-25494, published 2021-10-06. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. A possible buffer overflow vulnerability in libSPenBase library of Samsung Notes prior to Samsung Note version 4.3.02.61 allows arbitrary code execution.
• CVE-2025-20976, published 2025-05-07. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. Out-of-bounds read in applying binary of text content in Samsung Notes prior to version 4.4.29.23 allows attackers to read out-of-bounds memory.
• CVE-2021-25498, published 2021-10-06. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. A possible buffer overflow vulnerability in maetd_eco_cb_mode of libSPenBase library of Samsung Notes prior to Samsung Notes version 4.3.02.61 allows arbitrary code execution.
• CVE-2021-25497, published 2021-10-06. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. A possible buffer overflow vulnerability in maetd_cpy_slice of libSPenBase library of Samsung Notes prior to Samsung Notes version 4.3.02.61 allows arbitrary code execution.
• CVE-2021-25496, published 2021-10-06. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. A possible buffer overflow vulnerability in maetd_dec_slice of libSPenBase library of Samsung Notes prior to Samsung Notes version 4.3.02.61 allows arbitrary code execution.
• CVE-2021-25495, published 2021-10-06. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. A possible heap buffer overflow vulnerability in libSPenBase library of Samsung Notes prior to Samsung Note version 4.3.02.61 allows arbitrary code execution.
• CVE-2025-20922, published 2025-03-06. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. Out-of-bounds read in appending text paragraph in Samsung Notes prior to version 4.4.26.71 allows attackers to read out-of-bounds memory.

Latest

• CVE-2026-21107, published 2026-09-09. Medium severity, CVSS 5.5. EPSS: 0.1% chance of exploitation in the next 30 days. Out-of-bounds write in Samsung Notes prior to version 4.4.45.5 allows local attackers to write out-of-bounds memory.
• CVE-2025-21070, published 2025-10-10. Medium severity, CVSS 5.5. EPSS: 0.1% chance of exploitation in the next 30 days. Out-of-bounds write in the SPI decoder in Samsung Notes prior to version 4.4.30.63 allows local attackers to write out-of-bounds memory.
• CVE-2025-21069, published 2025-10-10. High severity, CVSS 7.1. EPSS: 0.1% chance of exploitation in the next 30 days. Out-of-bounds read in the parsing of image data in Samsung Notes prior to version 4.4.30.63 allows local attackers to access out-of-bounds memory.
• CVE-2025-21068, published 2025-10-10. High severity, CVSS 7.1. EPSS: 0.1% chance of exploitation in the next 30 days. Out-of-bounds read in the reading of image data in Samsung Notes prior to version 4.4.30.63 allows local attackers to access out-of-bounds memory.
• CVE-2025-21067, published 2025-10-10. High severity, CVSS 7.1. EPSS: 0.1% chance of exploitation in the next 30 days. Out-of-bounds read in the allocation of image buffer in Samsung Notes prior to version 4.4.30.63 allows local attackers to access out-of-bounds memory.
• CVE-2025-21066, published 2025-10-10. High severity, CVSS 7.1. EPSS: 0.1% chance of exploitation in the next 30 days. Out-of-bounds read in the SPI decoder in Samsung Notes prior to version 4.4.30.63 allows local attackers to access out-of-bounds memory.
• CVE-2025-21057, published 2025-10-10. Low severity, CVSS 3.3. EPSS: 0.1% chance of exploitation in the next 30 days. Use of implicit intent for sensitive communication in Samsung Notes prior to version 4.4.30.63 allows local attackers to access shared notes.
• CVE-2025-21037, published 2025-09-03. Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days. Improper access control in Samsung Notes prior to version 4.4.30.63 allows physical attackers to access data across multiple user profiles. User interaction is required for triggering this…
• CVE-2025-21036, published 2025-09-03. Medium severity, CVSS 5.0. EPSS: 0.1% chance of exploitation in the next 30 days. Improper access control in Samsung Notes prior to version 4.4.30.63 allows local privileged attackers to access exported note files. User interaction is required for triggering this vulnerability.
• CVE-2025-20977, published 2025-05-07. Low severity, CVSS 3.3. EPSS: 0.2% chance of exploitation in the next 30 days. Use of implicit intent for sensitive communication in translation in Samsung Notes prior to version 4.4.29.23 allows local attackers to get sensitive information. User interaction is required for…