Improper access control in Samsung Gallery prior to version 14.5.10.3 in Global Android…
Priority LOW 21Published · Updated
Key facts
- Attack vector
- Physical
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
Improper access control in Samsung Gallery prior to version 14.5.10.3 in Global Android 13, 14.5.09.3 in China Android 13, and 15.5.04.5 in Android 14 allows physical attackers to access data across multiple user profiles.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00213 11th percentileScored 2026-11-07
Fix Fixed Samsung Gallery (Samsung Mobile): 14.5.10.3 in Global Android 13, 14.5.09.3 in China Android 13, and 15.5.04.5 in Android 14
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Samsung | Samsung Gallery | — | 14.5.10.3 in Global Android 13, 14.5.09.3 in China Android 13, and 15.5.04.5 in Android 14 | Patch available | CNA |
- Samsung Gallery VendorSamsung Affected — Fixed in 14.5.10.3 in Global Android 13, 14.5.09.3 in China Android 13, and 15.5.04.5 in Android 14 Patch available CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:samsung:gallery:*:*:*:*:*:*:*:* | before 14.5.10.3 | Vulnerable | Samsung |
| cpe:2.3:o:samsung:android:13.0:-:*:*:*:*:*:* | 13.0 | Running on | Samsung |
| cpe:2.3:a:samsung:gallery:*:*:*:*:*:*:*:* | before 14.5.09.3; before 15.5.04.5 | Vulnerable | Samsung |
| cpe:2.3:o:samsung:android:14.0:-:*:*:*:*:*:* | 14.0 | Running on | Samsung |
- cpe:2.3:a:samsung:gallery:*:*:*:*:*:*:*:* Versions before 14.5.10.3 Vulnerable ·Samsung
- cpe:2.3:o:samsung:android:13.0:-:*:*:*:*:*:* Versions 13.0 Running on ·Samsung
- cpe:2.3:a:samsung:gallery:*:*:*:*:*:*:*:* Versions before 14.5.09.3; before 15.5.04.5 Vulnerable ·Samsung
- cpe:2.3:o:samsung:android:14.0:-:*:*:*:*:*:* Versions 14.0 Running on ·Samsung
Remediation
- Fix · CNA Samsung Gallery (Samsung Mobile) Fixed in 14.5.10.3 in Global Android 13, 14.5.09.3 in China Android 13, and 15.5.04.5 in Android 14
Timeline
- 2026-10-02 Threatist record created from CVE-2025-20966
- 2026-10-03 Alias added: GHSA-f3f4-3g45-5gh4
References
More Samsung Gallery vulnerabilities
- TI-2025-14964 Improper access control in Samsung Gallery prior to version 14.5.10.3 in Global Android… CVSS 3.1CRITICAL 9.1
- TI-2025-14963 Improper access control in Samsung Gallery prior to version 14.5.10.3 in Global Android… CVSS 3.1CRITICAL 9.1
- TI-2025-14965 Improper input validation in Samsung Gallery prior to version 14.5.10.3 in Global Android… CVSS 3.1MEDIUM 5.5
- TI-2023-14539 Improper authentication in Samsung Gallery CVSS 3.1MEDIUM 5.5
- TI-2024-13621 Improper access control vulnerability in Samsung Gallery prior to version 14.5.04.4… CVSS 3.1MEDIUM 4.6
- TI-2023-14538 Improper authentication in Samsung Gallery CVSS 3.1MEDIUM 4.0
Sources
- CVE-2025-20966 · CVE Program
- CVE-2025-20966 · NVD
- FIRST EPSS
- GHSA-f3f4-3g45-5gh4 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences