Code injection in Samsung Bixby Vision
Priority LOW 20CWE-94Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-94.
Summary
A vulnerability using PendingIntent in Bixby Vision prior to versions 3.7.60.8 in Android S(12), 3.7.50.6 in Andorid R(11) and below allows attackers to execute privileged action by hijacking and modifying the intent.
Why it matters now
EPSS 0.00237 14th percentileScored 2026-11-07
Fix Fixed Bixby Vision (Samsung Mobile): 3.7.60.8 in Android S(12), 3.7.50.6 in Andorid R(11) and below
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Samsung | Bixby Vision | - to before 3.7.60.8 in Android S(12), 3.7.50.6 in Andorid R(11) and below | 3.7.60.8 in Android S(12), 3.7.50.6 in Andorid R(11) and below | Patch available | CNA |
- Bixby Vision VendorSamsung Affected - to before 3.7.60.8 in Android S(12), 3.7.50.6 in Andorid R(11) and below Fixed in 3.7.60.8 in Android S(12), 3.7.50.6 in Andorid R(11) and below Patch available CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:samsung:bixby:*:*:*:*:*:*:*:* | before 3.7.50.6 | Vulnerable | Samsung |
| cpe:2.3:o:google:android:11.0:*:*:*:*:*:*:* | 11.0 | Running on | |
| cpe:2.3:a:samsung:bixby:*:*:*:*:*:*:*:* | before 3.7.60.8 | Vulnerable | Samsung |
| cpe:2.3:o:google:android:12.0:*:*:*:*:*:*:* | 12.0 | Running on |
- cpe:2.3:a:samsung:bixby:*:*:*:*:*:*:*:* Versions before 3.7.50.6 Vulnerable ·Samsung
- cpe:2.3:o:google:android:11.0:*:*:*:*:*:*:* Versions 11.0 Running on ·Google
- cpe:2.3:a:samsung:bixby:*:*:*:*:*:*:*:* Versions before 3.7.60.8 Vulnerable ·Samsung
- cpe:2.3:o:google:android:12.0:*:*:*:*:*:*:* Versions 12.0 Running on ·Google
Remediation
- Fix · CNA Bixby Vision (Samsung Mobile) Fixed in 3.7.60.8 in Android S(12), 3.7.50.6 in Andorid R(11) and below
Timeline
- 2026-10-02 Threatist record created from CVE-2022-23434
- 2026-10-03 Alias added: GHSA-2gw6-v2h7-g6vm
References
More Samsung Bixby vulnerabilities
- TI-2021-07619 Improper handling of exceptional conditions in Samsung Bixby CVSS 3.1HIGH 7.3
- TI-2026-17125 Improper export of android application components in Bixby Touch prior to version… CVSS 4.0MEDIUM 6.9
- TI-2025-14961 Improper handling of insufficient permission in Bixby wakeup prior to version 2.3.74.8… CVSS 3.1MEDIUM 6.2
Sources
- CVE-2022-23434 · CVE Program
- CVE-2022-23434 · NVD
- FIRST EPSS
- GHSA-2gw6-v2h7-g6vm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences