CVE-2025-21080: 
NixOS vulnerability analysis and mitigation

CVE-2025-21080 is an improper export of Android application components vulnerability in Samsung's Dynamic Lockscreen feature, allowing local attackers to access files with Dynamic Lockscreen's elevated privileges. It affects Samsung Android versions 15.0 and 16.0 prior to the SMR Dec-2025 Release 1 patch. The vulnerability was published on December 2, 2025, and a patch was made available in the Samsung Mobile Release (SMR) December 2025 update. It carries a CVSS v3.1 base score of 7.1 (High) (Samsung Advisory, Red Hat CVE).

The root cause is classified as CWE-926 (Improper Export of Android Application Components), where the Dynamic Lockscreen application improperly exports one or more of its components (e.g., activities, services, or content providers), making them accessible to other applications on the device without proper authorization checks. A local attacker with low privileges can invoke these exported components to read or manipulate files that the Dynamic Lockscreen application has access to, without requiring user interaction. No public technical write-ups or proof-of-concept code have been identified at this time (Samsung Advisory, ENISA EUVD).

Successful exploitation allows a local attacker to access and potentially modify files within the Dynamic Lockscreen application's privilege scope, resulting in high confidentiality and high integrity impact with no availability impact. The attack is limited to the local device and does not enable remote code execution or lateral movement across a network, but could expose sensitive data stored or accessible by the Dynamic Lockscreen component on affected Samsung devices running Android 15.0 or 16.0 (Samsung Advisory, ENISA EUVD).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication. The EPSS score is approximately 0.012% (0.000120), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported (Samsung Advisory, Red Hat CVE).

Samsung has addressed this vulnerability in the SMR Dec-2025 Release 1 for Samsung Android versions 15.0 and 16.0. Users and administrators should apply the December 2025 Samsung security update as soon as possible. As interim measures, organizations can monitor for suspicious file access attempts involving the Dynamic Lockscreen application and implement additional access controls for sensitive application components (Samsung Advisory).