Samsung Libsthmbc.so Out-of-Bounds Write Vulnerability Allowing Arbitrary Code Execution

A high-severity out-of-bounds write vulnerability has been identified in the libsthmbc.so library, affecting several Android 12, 13, and 14 devices. This vulnerability arises from accessing uninitialized memory in the svc1td function, which can lead to arbitrary code execution with elevated privileges. Exploitation of this vulnerability requires user interaction.

Impact

Exploitation of this vulnerability allows local attackers to execute arbitrary code with privileges on the affected device.

Remediation

Users can apply the January 2025 Security Maintenance Release (SMR) to address this vulnerability. Instructions for updating can be found on the Samsung Mobile Security website.