CVE-2021-25372: Samsung Android DSP driver improper boundary check allows out-of-bounds memory access

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityThe flaw is in CISA KEV with confirmed exploitation, but the local high-privilege vector and low EPSS score limit broad opportunistic risk.

What it is

The Samsung DSP driver in Android contains an improper boundary check that permits out-of-bounds memory access. The flaw is fixed in SMR Mar-2021 Release 1, so unpatched Samsung devices remain exposed. Because the DSP driver handles media processing, memory corruption there can be reached through crafted input rather than only through a local app.

Impact

An attacker who can trigger the boundary check failure gains out-of-bounds read/write in the DSP driver, which can corrupt memory and potentially lead to code execution in the driver context. The CVSS vector rates confidentiality, integrity and availability impact as high.

Attack surface

The CVSS vector is local (AV:L) with high privileges required (PR:H) and no user interaction (UI:N), so exploitation requires an attacker to already have a privileged local position on the device. The description does not specify the exact entry point into the DSP driver.

Exploitation

CVE-2021-25372 is listed in CISA KEV with a due date of 2023-07-20, indicating known exploitation in the wild, though the EPSS 30-day probability is low at roughly 0.8 percent. No ransomware campaign use is documented.

What to do

• Apply the Samsung SMR Mar-2021 Release 1 or later security update to affected devices.
• If updates are unavailable, discontinue use of the affected device per CISA guidance.
• Restrict local privileged access and review which apps or services can reach the DSP driver.
• Track device patch levels and enforce minimum security patch versions in MDM policy.

Detection

• Monitor for crashes or abnormal restarts tied to DSP or media driver components.
• Alert on unexpected privileged local processes interacting with DSP driver interfaces.
• Correlate device patch level against SMR Mar-2021 Release 1 to find unpatched endpoints.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.