PT-2025-4163 · Unknown · Libsthmbc.So

Published 2025-02-04 · Updated 2025-02-12 · CVE-2025-20881

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions libsthmbc.so versions prior to SMR Jan-2025 Release 1

Description The issue is an out-of-bounds write in accessing a buffer that stores decoded video frames. This allows local attackers to execute arbitrary code with privilege, but user interaction is required to trigger the vulnerability.

Recommendations For versions prior to SMR Jan-2025 Release 1, as a temporary workaround, consider restricting access to the libsthmbc.so library until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2025-20881

Affected Products

Libsthmbc.So

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-20881 · Security Note
• https://osv.dev/vulnerability/CVE-2025-20881 · Vendor Advisory
• https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=01 · Vendor Advisory
• https://t.me/cvenotify/109816 · Telegram Post
• https://twitter.com/CVEnew/status/1886680238257778894 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1886771696775946334 · Twitter Post
• https://t.me/cvenotify/111037 · Telegram Post