PT-2026-1297 · Samsung · Samsung Magician

Published 2025-08-11 · Updated 2026-01-07 · CVE-2025-57836

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Samsung Magician versions 6.3.0 through 8.3.2

Description The software installer creates a temporary folder with insufficient permissions during the installation process on Windows. This allows a non-administrative user to potentially perform DLL hijacking and gain elevated privileges.

Recommendations Versions prior to 6.3.0 are not affected. Versions 6.3.0 through 8.3.2 are affected and require attention.

Fix

LPE

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

BDU:2026-00632

CVE-2025-57836

Affected Products

Samsung Magician

References · 10

• https://bdu.fstec.ru/vul/2026-00632 · Security Note
• https://semiconductor.samsung.com/support/quality-support/product-security-updates · Vendor Advisory
• https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-57836 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-57836 · Security Note
• https://osv.dev/vulnerability/CVE-2025-57836 · Vendor Advisory
• https://twitter.com/CVEnew/status/2008220678525272297 · Twitter Post
• https://t.me/tmfeed/280154 · Telegram Post
• https://t.me/CVEtracker/41401 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2008289771731202298 · Twitter Post
• https://twitter.com/GameGPU_com/status/2008880128370123079 · Twitter Post