How severe is CVE-2025-21020?

CVE-2025-21020 has a CVSS 3.x base score of 5.7, rated medium severity. It is exploitable over local access with high attack complexity, requires high privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability none.

Is CVE-2025-21020 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (3rd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2025-21020?

CVE-2025-21020 affects Samsung Blockchain Keystore. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2025-21020?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2025-21020 have an EU (EUVD) identifier?

Yes. CVE-2025-21020 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-23770.

When was CVE-2025-21020 published?

CVE-2025-21020 was published on 2025-08-06 and last updated on 2026-06-17.

CVE-2025-21020

CVE-2025-21020 is a medium-severity vulnerability in Samsung Blockchain Keystore with a CVSS 3.x base score of 5.7. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-787.

Key facts

Severity: Medium (CVSS 3.x base score 5.7)
EPSS exploit prediction: 0% (3rd percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2025-23770
Weakness: CWE-787
Affected product: Samsung Blockchain Keystore
Published: 2025-08-06
Last modified: 2026-06-17

Description

Out-of-bounds write in creating bitmap images in Blockchain Keystore prior to version 1.3.17.2 allows local privileged attackers to write out-of-bounds memory.

Frequently asked questions

What is CVE-2025-21020?: Out-of-bounds write in creating bitmap images in Blockchain Keystore prior to version 1.3.17.2 allows local privileged attackers to write out-of-bounds memory.
How severe is CVE-2025-21020?: CVE-2025-21020 has a CVSS 3.x base score of 5.7, rated medium severity. It is exploitable over local access with high attack complexity, requires high privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability none.
Is CVE-2025-21020 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (3rd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2025-21020?: CVE-2025-21020 affects Samsung Blockchain Keystore. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2025-21020?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2025-21020 have an EU (EUVD) identifier?: Yes. CVE-2025-21020 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-23770.
When was CVE-2025-21020 published?: CVE-2025-21020 was published on 2025-08-06 and last updated on 2026-06-17.

References

https://security.samsungmobile.com/serviceWeb.smsb?year=2025&month=08

Affected products (1)

cpe:2.3:a:samsung:blockchain_keystore:*:*:*:*:*:*:*:*

More vulnerabilities in Samsung Blockchain Keystore

CVE-2024-49406 — Medium (CVSS 6.7): Improper validation of integrity check value in Blockchain Keystore prior to version 1.3.16 allows local attackers to…
CVE-2025-21017 — Medium (CVSS 6.3): Out-of-bounds write in detaching crypto box in Blockchain Keystore prior to version 1.3.17.2 allows local privileged…
CVE-2025-20900 — Medium (CVSS 6.3): Out-of-bounds write in Blockchain Keystore prior to version 1.3.16.5 allows local privileged attackers to write…
CVE-2025-21021 — Medium (CVSS 5.7): Out-of-bounds write in drawing pinpad in Blockchain Keystore prior to version 1.3.17.2 allows local privileged…
CVE-2023-30722 — Medium (CVSS 5.5): Protection Mechanism Failure in bc_tui trustlet from Samsung Blockchain Keystore prior to version 1.3.13.5 allows local…
CVE-2025-21018 — Medium (CVSS 4.4): Out-of-bounds read in Blockchain Keystore prior to version 1.3.17.2 allows local privileged attackers to read…

All CVEs affecting Samsung Blockchain Keystore →

Other CWE-787 (Out-of-bounds Write) vulnerabilities

CVE-2026-42369 — Critical (CVSS 10.0): GV-VMS V20 is a Video Monitoring Software used to gather the feeds of many surveillance cameras and manage other…
CVE-2026-4746 — Critical (CVSS 10.0): Out-of-bounds Write vulnerability in timeplus-io proton (base/poco/Foundation/src‎ modules). This vulnerability is…
CVE-2025-43300 — Critical (CVSS 10.0): An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.8.5 and iPadOS…
CVE-2025-24201 — Critical (CVSS 10.0): An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in…
CVE-2024-42479 — Critical (CVSS 10.0): llama.cpp provides LLM inference in C/C++. The unsafe `data` pointer member in the `rpc_tensor` structure can cause…
CVE-2024-39791 — Critical (CVSS 10.0): Stack-based buffer overflow vulnerabilities affecting Vonets industrial wifi bridge relays and wifi bridge…

Browse all CWE-787 (Out-of-bounds Write) vulnerabilities →