Improper Access Control in Samsung Video Player prior to versions 7.3.29.1 in Android 12…
Priority LOW 24Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
Improper Access Control in Samsung Video Player prior to versions 7.3.29.1 in Android 12, 7.3.36.1 in Android 13, and 7.3.41.230 in Android 14 allows physical attackers to access video file of other users.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00157 4th percentileScored 2026-11-07
Fix Fixed Samsung Video Player (Samsung Mobile): 7.3.29.1 in Android 12, 7.3.36.1 in Android 13, and 7.3.41.230 in Android 14
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Samsung | Samsung Video Player | — | 7.3.29.1 in Android 12, 7.3.36.1 in Android 13, and 7.3.41.230 in Android 14 | Patch available | CNA |
- Samsung Video Player VendorSamsung Affected — Fixed in 7.3.29.1 in Android 12, 7.3.36.1 in Android 13, and 7.3.41.230 in Android 14 Patch available CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:samsung:video_player:*:*:*:*:*:*:*:* | before 7.3.29.1 | Vulnerable | Samsung |
| cpe:2.3:o:samsung:android:12.0:-:*:*:*:*:*:* | 12.0 | Running on | Samsung |
| cpe:2.3:a:samsung:video_player:*:*:*:*:*:*:*:* | before 7.3.36.1 | Vulnerable | Samsung |
| cpe:2.3:o:samsung:android:13.0:-:*:*:*:*:*:* | 13.0 | Running on | Samsung |
| cpe:2.3:a:samsung:video_player:*:*:*:*:*:*:*:* | before 7.3.41.230 | Vulnerable | Samsung |
| cpe:2.3:o:samsung:android:14.0:-:*:*:*:*:*:* | 14.0 | Running on | Samsung |
- cpe:2.3:a:samsung:video_player:*:*:*:*:*:*:*:* Versions before 7.3.29.1 Vulnerable ·Samsung
- cpe:2.3:o:samsung:android:12.0:-:*:*:*:*:*:* Versions 12.0 Running on ·Samsung
- cpe:2.3:a:samsung:video_player:*:*:*:*:*:*:*:* Versions before 7.3.36.1 Vulnerable ·Samsung
- cpe:2.3:o:samsung:android:13.0:-:*:*:*:*:*:* Versions 13.0 Running on ·Samsung
- cpe:2.3:a:samsung:video_player:*:*:*:*:*:*:*:* Versions before 7.3.41.230 Vulnerable ·Samsung
- cpe:2.3:o:samsung:android:14.0:-:*:*:*:*:*:* Versions 14.0 Running on ·Samsung
Remediation
- Fix · CNA Samsung Video Player (Samsung Mobile) Fixed in 7.3.29.1 in Android 12, 7.3.36.1 in Android 13, and 7.3.41.230 in Android 14
Timeline
- 2026-10-02 Threatist record created from CVE-2024-49404
- 2026-10-03 Alias added: GHSA-rmm5-5cm7-rrqv
References
More Samsung Video Player vulnerabilities
- TI-2022-08732 Improper privilege management in Samsung Video Player CVSS 3.1CRITICAL 9.8
- TI-2024-22971 Improper input validation in SamsungVideoPlayer prior to versions 7.3.29.1 in Android 12… CVSS 3.1MEDIUM 5.5
Sources
- CVE-2024-49404 · CVE Program
- CVE-2024-49404 · NVD
- FIRST EPSS
- GHSA-rmm5-5cm7-rrqv · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences