Improper input validation in SamsungVideoPlayer prior to versions 7.3.29.1 in Android 12…
Priority LOW 24Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
Improper input validation in SamsungVideoPlayer prior to versions 7.3.29.1 in Android 12, 7.3.36.1 in Android 13, and 7.3.41.230 in Android 14 allows local attackers to access video file of other users.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00156 4th percentileScored 2026-11-07
Fix Fixed SamsungVideoPlayer (Samsung Mobile): 7.3.29.1 in Android 12, 7.3.36.1 in Android 13 and 7.3.41.230 in Android 14
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Samsung | SamsungVideoPlayer | — | 7.3.29.1 in Android 12, 7.3.36.1 in Android 13 and 7.3.41.230 in Android 14 | Patch available | CNA |
- SamsungVideoPlayer VendorSamsung Affected — Fixed in 7.3.29.1 in Android 12, 7.3.36.1 in Android 13 and 7.3.41.230 in Android 14 Patch available CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:samsung:video_player:*:*:*:*:*:*:*:* | before 7.3.29.1 | Vulnerable | Samsung |
| cpe:2.3:o:samsung:android:12.0:*:*:*:*:*:*:* | 12.0 | Running on | Samsung |
| cpe:2.3:a:samsung:video_player:*:*:*:*:*:*:*:* | before 7.3.36.1 | Vulnerable | Samsung |
| cpe:2.3:o:samsung:android:13.0:*:*:*:*:*:*:* | 13.0 | Running on | Samsung |
| cpe:2.3:a:samsung:video_player:*:*:*:*:*:*:*:* | before 7.3.41.230 | Vulnerable | Samsung |
| cpe:2.3:o:samsung:android:14.0:*:*:*:*:*:*:* | 14.0 | Running on | Samsung |
- cpe:2.3:a:samsung:video_player:*:*:*:*:*:*:*:* Versions before 7.3.29.1 Vulnerable ·Samsung
- cpe:2.3:o:samsung:android:12.0:*:*:*:*:*:*:* Versions 12.0 Running on ·Samsung
- cpe:2.3:a:samsung:video_player:*:*:*:*:*:*:*:* Versions before 7.3.36.1 Vulnerable ·Samsung
- cpe:2.3:o:samsung:android:13.0:*:*:*:*:*:*:* Versions 13.0 Running on ·Samsung
- cpe:2.3:a:samsung:video_player:*:*:*:*:*:*:*:* Versions before 7.3.41.230 Vulnerable ·Samsung
- cpe:2.3:o:samsung:android:14.0:*:*:*:*:*:*:* Versions 14.0 Running on ·Samsung
Remediation
- Fix · CNA SamsungVideoPlayer (Samsung Mobile) Fixed in 7.3.29.1 in Android 12, 7.3.36.1 in Android 13 and 7.3.41.230 in Android 14
Timeline
- 2026-10-02 Threatist record created from CVE-2024-34672
- 2026-10-03 Alias added: GHSA-pvj2-49v4-xqh3
References
More Samsung Video Player vulnerabilities
- TI-2022-08732 Improper privilege management in Samsung Video Player CVSS 3.1CRITICAL 9.8
- TI-2024-32989 Improper Access Control in Samsung Video Player prior to versions 7.3.29.1 in Android 12… CVSS 3.1MEDIUM 5.5
Sources
- CVE-2024-34672 · CVE Program
- CVE-2024-34672 · NVD
- FIRST EPSS
- GHSA-pvj2-49v4-xqh3 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences