Improper input validation in Samsung Gallery prior to version 14.5.10.3 in Global Android…
Priority LOW 24Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
Improper input validation in Samsung Gallery prior to version 14.5.10.3 in Global Android 13, 14.5.09.3 in China Android 13, and 15.5.04.5 in Android 14 allows local attackers to access data within Samsung Gallery.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00158 4th percentileScored 2026-11-07
Fix Fixed Samsung Gallery (Samsung Mobile): 14.5.10.3 in Global Android 13, 14.5.09.3 in China Android 13, and 15.5.04.5 in Android 14
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Samsung | Samsung Gallery | — | 14.5.10.3 in Global Android 13, 14.5.09.3 in China Android 13, and 15.5.04.5 in Android 14 | Patch available | CNA |
- Samsung Gallery VendorSamsung Affected — Fixed in 14.5.10.3 in Global Android 13, 14.5.09.3 in China Android 13, and 15.5.04.5 in Android 14 Patch available CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:samsung:gallery:*:*:*:*:*:*:*:* | before 14.5.10.3 | Vulnerable | Samsung |
| cpe:2.3:o:samsung:android:13.0:-:*:*:*:*:*:* | 13.0 | Running on | Samsung |
| cpe:2.3:a:samsung:gallery:*:*:*:*:*:*:*:* | before 14.5.09.3; before 15.5.04.5 | Vulnerable | Samsung |
| cpe:2.3:o:samsung:android:14.0:-:*:*:*:*:*:* | 14.0 | Running on | Samsung |
- cpe:2.3:a:samsung:gallery:*:*:*:*:*:*:*:* Versions before 14.5.10.3 Vulnerable ·Samsung
- cpe:2.3:o:samsung:android:13.0:-:*:*:*:*:*:* Versions 13.0 Running on ·Samsung
- cpe:2.3:a:samsung:gallery:*:*:*:*:*:*:*:* Versions before 14.5.09.3; before 15.5.04.5 Vulnerable ·Samsung
- cpe:2.3:o:samsung:android:14.0:-:*:*:*:*:*:* Versions 14.0 Running on ·Samsung
Remediation
- Fix · CNA Samsung Gallery (Samsung Mobile) Fixed in 14.5.10.3 in Global Android 13, 14.5.09.3 in China Android 13, and 15.5.04.5 in Android 14
Timeline
- 2026-10-02 Threatist record created from CVE-2025-20969
- 2026-10-03 Alias added: GHSA-g2w4-f56h-2wj6
References
More Samsung Gallery vulnerabilities
- TI-2025-14964 Improper access control in Samsung Gallery prior to version 14.5.10.3 in Global Android… CVSS 3.1CRITICAL 9.1
- TI-2025-14963 Improper access control in Samsung Gallery prior to version 14.5.10.3 in Global Android… CVSS 3.1CRITICAL 9.1
- TI-2023-14539 Improper authentication in Samsung Gallery CVSS 3.1MEDIUM 5.5
- TI-2025-14962 Improper access control in Samsung Gallery prior to version 14.5.10.3 in Global Android… CVSS 3.1MEDIUM 4.6
- TI-2024-13621 Improper access control vulnerability in Samsung Gallery prior to version 14.5.04.4… CVSS 3.1MEDIUM 4.6
- TI-2023-14538 Improper authentication in Samsung Gallery CVSS 3.1MEDIUM 4.0
Sources
- CVE-2025-20969 · CVE Program
- CVE-2025-20969 · NVD
- FIRST EPSS
- GHSA-g2w4-f56h-2wj6 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences