Code injection in Samsung Accessibility
Priority LOW 35CWE-94Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution, Information disclosure
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-94 and CWE-552.
Summary
A vulnerability using PendingIntent in Accessibility prior to version 12.5.3.2 in Android R(11.0) and 13.0.1.1 in Android S(12.0) allows attacker to access the file with system privilege.
Why it matters now
EPSS 0.00558 46th percentileScored 2026-11-07
Fix Fixed Accessibility (Samsung Mobile): 12.5.3.2 in Android R(11.0) and 13.0.1.1 in Android S(12.0)
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Samsung | Accessibility | - to before 12.5.3.2 in Android R(11.0) and 13.0.1.1 in Android S(12.0) | 12.5.3.2 in Android R(11.0) and 13.0.1.1 in Android S(12.0) | Patch available | CNA |
- Accessibility VendorSamsung Affected - to before 12.5.3.2 in Android R(11.0) and 13.0.1.1 in Android S(12.0) Fixed in 12.5.3.2 in Android R(11.0) and 13.0.1.1 in Android S(12.0) Patch available CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:samsung:accessibility:*:*:*:*:*:*:*:* | before 12.5.3.2 | Vulnerable | Samsung |
| cpe:2.3:o:google:android:11.0:*:*:*:*:*:*:* | 11.0 | Running on | |
| cpe:2.3:a:samsung:accessibility:*:*:*:*:*:*:*:* | before 13.0.1.1 | Vulnerable | Samsung |
| cpe:2.3:o:google:android:12.0:*:*:*:*:*:*:* | 12.0 | Running on |
- cpe:2.3:a:samsung:accessibility:*:*:*:*:*:*:*:* Versions before 12.5.3.2 Vulnerable ·Samsung
- cpe:2.3:o:google:android:11.0:*:*:*:*:*:*:* Versions 11.0 Running on ·Google
- cpe:2.3:a:samsung:accessibility:*:*:*:*:*:*:*:* Versions before 13.0.1.1 Vulnerable ·Samsung
- cpe:2.3:o:google:android:12.0:*:*:*:*:*:*:* Versions 12.0 Running on ·Google
Remediation
- Fix · CNA Accessibility (Samsung Mobile) Fixed in 12.5.3.2 in Android R(11.0) and 13.0.1.1 in Android S(12.0)
Timeline
- 2026-10-02 Threatist record created from CVE-2022-27837
- 2026-10-03 Alias added: GHSA-h84w-mw8f-pj69
References
Sources
- CVE-2022-27837 · CVE Program
- CVE-2022-27837 · NVD
- FIRST EPSS
- GHSA-h84w-mw8f-pj69 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences