CVE-2025-21072 Overview
CVE-2025-21072 is an out-of-bounds write vulnerability [CWE-787] in the fingerprint trustlet of Samsung Android devices. The flaw resides in the metadata decoding logic executed within the trusted execution environment (TEE). A local attacker with elevated privileges can supply crafted metadata to the trustlet to write data outside intended memory boundaries. Samsung addressed the issue in the SMR Dec-2025 Release 1 security maintenance update. The vulnerability affects Samsung Android versions 13, 14, 15, and 16 across multiple prior SMR releases.
Critical Impact
A local privileged attacker can corrupt memory inside the fingerprint trustlet, undermining the integrity of biometric authentication processing on affected Samsung Android devices.
Affected Products
- Samsung Android 13.0 prior to SMR Dec-2025 Release 1
- Samsung Android 14.0 prior to SMR Dec-2025 Release 1
- Samsung Android 15.0 and 16.0 prior to SMR Dec-2025 Release 1
Discovery Timeline
- 2025-12-02 - CVE-2025-21072 published to the National Vulnerability Database (NVD)
- December 2025 - Samsung releases fix in SMR Dec-2025 Release 1 security maintenance update
- 2025-12-05 - Last updated in NVD database
Technical Details for CVE-2025-21072
Vulnerability Analysis
The vulnerability is an out-of-bounds write [CWE-787] located in the fingerprint trustlet, a trusted application running inside the device's TrustZone-based secure world. The trustlet handles fingerprint enrollment, template storage, and matching using sensitive biometric data. During decoding of metadata associated with fingerprint operations, the trustlet writes data beyond the bounds of an allocated buffer.
Exploitation requires local access and high privileges on the device. The attack does not require user interaction. Successful exploitation impacts integrity within the trustlet boundary but does not directly expose confidentiality or availability per the vendor scoring. Corruption of trustlet memory can disrupt biometric integrity guarantees that downstream Android components rely on for authentication decisions.
Root Cause
The root cause is missing or insufficient bounds validation while parsing untrusted metadata supplied to the fingerprint trustlet. The decoder accepts attacker-influenced length or offset fields and uses them to write into a fixed-size buffer without proper size checks. This pattern matches the classic CWE-787 weakness class.
Attack Vector
An attacker first needs a privileged context on the device — typically a compromised system service or a process able to communicate with the fingerprint HAL and reach the trustlet interface. The attacker then crafts a malformed metadata blob whose decoded representation exceeds the destination buffer. When the trustlet processes this blob, the out-of-bounds write occurs inside the secure world. No remote vector exists, and no end-user interaction is required.
No public proof-of-concept exploit code is available for CVE-2025-21072. Technical details should be referenced from the Samsung Mobile Security Update.
Detection Methods for CVE-2025-21072
Indicators of Compromise
- Unexpected crashes or restarts of the fingerprint service (vendor.samsung.hardware.biometrics.fingerprint) or related HAL processes on the device.
- Trustlet error entries in kernel and TEE logs referencing fingerprint operations or memory faults inside the secure world.
- Anomalous failures during fingerprint enrollment or authentication that correlate with privileged process activity.
Detection Strategies
- Monitor Samsung Android fleet build numbers via mobile device management (MDM) tooling to identify devices that have not received the SMR Dec-2025 Release 1 patch.
- Audit processes and apps holding privileged biometric-related permissions or system signatures, as exploitation requires a pre-existing privileged foothold.
- Correlate biometric subsystem crash telemetry with installed application changes to surface suspicious sequences preceding trustlet faults.
Monitoring Recommendations
- Ingest Android logcat, dropbox, and tombstone artifacts into a centralized logging platform and alert on fingerprint trustlet faults.
- Track patch level (ro.build.version.security_patch) compliance across all managed Samsung devices on a recurring schedule.
- Watch for unauthorized escalation to system or vendor-privileged contexts, which is a prerequisite for reaching the vulnerable code path.
How to Mitigate CVE-2025-21072
Immediate Actions Required
- Apply the Samsung SMR Dec-2025 Release 1 security maintenance update to all affected Samsung Android 13, 14, 15, and 16 devices.
- Enforce patch-level compliance through MDM policies and quarantine devices that remain below the December 2025 patch level.
- Review and reduce the set of applications granted privileged or system-level permissions on managed Samsung devices.
Patch Information
Samsung released the fix in the SMR Dec-2025 Release 1 security maintenance update. Refer to the Samsung Mobile Security Update bulletin for the full list of patched builds and device models.
Workarounds
- No vendor-supplied workaround is published; patching is the only supported remediation path.
- Restrict installation of side-loaded applications and tighten privileged app provisioning until devices receive the December 2025 patch.
- Consider disabling fingerprint authentication in favor of PIN or passphrase on devices that cannot be promptly updated, where policy allows.
# Verify Samsung Android security patch level via adb
adb shell getprop ro.build.version.security_patch
# Expected value on patched devices: 2025-12-01 or later
# Confirm SMR build identifier
adb shell getprop ro.build.display.id
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
