Read the docs
TI-2025-15031 Aliases CVE-2025-21035GHSA-x2rm-qv9w-2p5q

Improper access control in Samsung Calendar prior to version 12.5.06.5 in Android 14 and…

Priority LOW 21Published · Updated

Key facts

Attack vector
Physical
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Improper access control in Samsung Calendar prior to version 12.5.06.5 in Android 14 and 12.6.01.12 in Android 15 allows physical attackers to access data across multiple user profiles.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00223 13th percentileScored 2026-11-07
Fix Fixed Samsung Calendar (Samsung Mobile): 12.5.06.5 in Android 14 and 12.6.01.12 in Android 15

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SamsungSamsung Calendar—12.5.06.5 in Android 14 and 12.6.01.12 in Android 15Patch availableCNA
  • Samsung Calendar VendorSamsung Affected — Fixed in 12.5.06.5 in Android 14 and 12.6.01.12 in Android 15 Patch available CNA

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:samsung:calendar:*:*:*:*:*:*:*:*before 12.5.06.5VulnerableSamsung
cpe:2.3:o:google:android:14.0:*:*:*:*:*:*:*14.0Running onGoogle
cpe:2.3:a:samsung:calendar:*:*:*:*:*:*:*:*before 12.6.01.12VulnerableSamsung
cpe:2.3:o:google:android:15.0:*:*:*:*:*:*:*15.0Running onGoogle
  • cpe:2.3:a:samsung:calendar:*:*:*:*:*:*:*:* Versions before 12.5.06.5 Vulnerable ·Samsung
  • cpe:2.3:o:google:android:14.0:*:*:*:*:*:*:* Versions 14.0 Running on ·Google
  • cpe:2.3:a:samsung:calendar:*:*:*:*:*:*:*:* Versions before 12.6.01.12 Vulnerable ·Samsung
  • cpe:2.3:o:google:android:15.0:*:*:*:*:*:*:* Versions 15.0 Running on ·Google

Remediation

  • Fix · CNA Samsung Calendar (Samsung Mobile) Fixed in 12.5.06.5 in Android 14 and 12.6.01.12 in Android 15

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-21035
  2. 2026-10-03 Alias added: GHSA-x2rm-qv9w-2p5q

References

Advisory 1

  • TI-2022-18909 Improper access control in Samsung Calendar CVSS 3.1MEDIUM 5.5
  • TI-2023-14492 Path traversal in Samsung Calendar CVSS 3.1MEDIUM 5.5
  • TI-2023-07865 Improper access control in Samsung Calendar prior to versions 12.4.02.9000 in Android 13… CVSS 3.1MEDIUM 4.0
  • TI-2022-14823 Improper authorization in Samsung Calendar CVSS 3.1LOW 3.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences