CVE-2025-21080 Overview
CVE-2025-21080 is a local privilege escalation vulnerability in the Samsung Dynamic Lockscreen component on Samsung Android devices. The flaw stems from improper export of Android application components, which allows a local attacker with low privileges to access files using the Dynamic Lockscreen application's privilege level. Samsung addressed the issue in the Security Maintenance Release (SMR) Dec-2025 Release 1 update.
The vulnerability affects Samsung Android 15.0 and 16.0 across multiple prior SMR builds. Successful exploitation results in unauthorized file access with elevated privileges, exposing confidential data and enabling integrity impact on the affected device.
Critical Impact
A local, low-privileged application can read and modify files accessible to Dynamic Lockscreen, leading to sensitive data disclosure and unauthorized changes on the device.
Affected Products
- Samsung Android 15.0 prior to SMR Dec-2025 Release 1 (including SMR Mar-2025 through SMR Nov-2025)
- Samsung Android 16.0 prior to SMR Dec-2025 Release 1 (including SMR Aug-2025 through SMR Nov-2025)
- Samsung devices shipping the Dynamic Lockscreen application
Discovery Timeline
- 2025-12-02 - CVE-2025-21080 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-21080
Vulnerability Analysis
The vulnerability resides in Samsung's Dynamic Lockscreen application, a preinstalled system component that manages lockscreen wallpapers and content. Dynamic Lockscreen exports one or more Android application components without adequate access controls. Any local application installed on the device can invoke the exposed component and cause Dynamic Lockscreen to operate on files on the caller's behalf.
Because Dynamic Lockscreen runs with system-level privileges tied to its signed package, file operations proxied through the exported component execute with those elevated permissions. This design flaw enables a confused-deputy scenario in which the malicious app leverages Dynamic Lockscreen to reach files it could not otherwise access. The result is confidentiality and integrity impact without requiring user interaction beyond initial app installation.
Root Cause
The root cause is an Android manifest and permission misconfiguration. The Dynamic Lockscreen package declares one or more activity, service, receiver, or provider components as exported without enforcing signature-level permissions or caller verification. Absent these controls, the platform routes any Intent from an unprivileged process directly into privileged code paths that touch the filesystem.
Attack Vector
Exploitation requires a locally installed malicious or compromised application on the Samsung device. The attacker crafts an Intent targeting the exposed Dynamic Lockscreen component and supplies parameters that direct file read or write operations to attacker-chosen paths. Because the operation executes under Dynamic Lockscreen's UID and permissions, the attacker gains access to files otherwise protected by the Android sandbox. No physical access, network access, or user interaction beyond running the malicious app is required.
No public proof-of-concept code has been released. See the Samsung Mobile Security Update for vendor technical details.
Detection Methods for CVE-2025-21080
Indicators of Compromise
- Presence of untrusted applications issuing Intents targeting Dynamic Lockscreen package components
- Unexpected file read or write activity attributed to the Dynamic Lockscreen UID in logcat or audit logs
- Installed third-party applications with queries or intent-filter entries referencing Dynamic Lockscreen component names
Detection Strategies
- Enumerate installed Samsung devices and verify the SMR build level against Dec-2025 Release 1 or later using mobile device management (MDM) inventory
- Review Android package manager data to identify applications that declare interaction with Dynamic Lockscreen components
- Use mobile threat defense tooling to flag applications that invoke exported system components with file path parameters
Monitoring Recommendations
- Ingest MDM compliance and patch-level telemetry into a centralized data lake and alert on devices running SMR builds earlier than Dec-2025 Release 1
- Monitor sideloading events and installations from non-Play Store sources on managed Samsung devices
- Track application behavior anomalies where unrelated user apps issue Intents to Samsung system packages
How to Mitigate CVE-2025-21080
Immediate Actions Required
- Apply the Samsung SMR Dec-2025 Release 1 update to all affected Samsung Android 15.0 and 16.0 devices
- Enforce minimum patch level policies through MDM to block noncompliant devices from accessing enterprise resources
- Audit installed applications on managed devices and remove untrusted or sideloaded packages
Patch Information
Samsung released the fix in Security Maintenance Release (SMR) Dec-2025 Release 1. Detailed advisory information is available in the Samsung Mobile Security Update bulletin for December 2025.
Workarounds
- No official vendor workaround is documented; patching is the only complete remediation
- Restrict installation of third-party or sideloaded applications through MDM policy until the patch is deployed
- Disable or restrict the Dynamic Lockscreen feature where organizational policy permits until devices receive the December 2025 SMR
# Example MDM compliance check: verify Samsung SMR patch level via adb
adb shell getprop ro.build.version.security_patch
adb shell getprop ro.build.PDA
# Ensure the security patch date corresponds to Samsung SMR Dec-2025 Release 1 or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
