CVE-2025-21026: 
NixOS vulnerability analysis and mitigation

CVE-2025-21026 is a vulnerability in Samsung's ImsService (IP Multimedia Subsystem Service) involving improper handling of insufficient permissions, which allows local attackers to interrupt active phone calls. It affects Samsung Android versions 13.0, 14.0, 15.0, and 16.0 prior to the SMR Sep-2025 Release 1. The vulnerability was published on September 3, 2025, with a patch released as part of Samsung's September 2025 Security Maintenance Release. It carries a CVSS v3.1 base score of 3.3 (Low) (Feedly, Samsung SMR).

The root cause is classified as CWE-280 (Improper Handling of Insufficient Permissions or Privileges) within the ImsService component of Samsung Android. The attack vector is local, requiring low privileges and no user interaction, with an unchanged scope. An attacker with local access to the device can exploit the insufficient permission checks in ImsService to disrupt or terminate ongoing calls. No public technical write-ups or proof-of-concept code have been identified for this vulnerability (Feedly, Samsung SMR).

Successful exploitation results in a limited availability impact — specifically, an attacker with local access can interrupt active phone calls on the affected Samsung device. There is no impact on confidentiality or integrity, and the vulnerability does not enable data theft, remote code execution, or lateral movement. The scope is limited to the affected device's telephony functionality (Feedly).

There is no public proof-of-concept exploit available, and no evidence of in-the-wild exploitation has been reported. The EPSS score is approximately 0.012% (0.000120), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been identified (Feedly).

Samsung has addressed this vulnerability in the SMR Sep-2025 Release 1, applicable to Samsung Android versions 13.0, 14.0, 15.0, and 16.0. Users and administrators should apply the September 2025 Samsung security update as soon as it is available for their device. As interim measures, restricting physical and local access to devices and monitoring for unusual call interruptions can reduce risk (Samsung SMR).

Coverage of CVE-2025-21026 has been limited to routine vulnerability tracking and aggregation sites, with no notable researcher commentary or significant media coverage identified. The vulnerability's low CVSS score and limited impact have not generated substantial community discussion (Feedly).