CVE-2025-20968 is a high severity flaw (CVSS 7.2) in Samsung Gallery (Android 13 and 14). Samsung rates it Moderate in its May 2025 bulletin as SVE-2024-1567. Update Samsung Gallery (Android 13 and 14) to 14.5.10.3 (Global Android 13), 14.5.09.3 (China Android 13) or 15.5.04.5 (Android 14) or later, or install the current version from the Galaxy Store or Play Store.
What's affected
- Product: Samsung Gallery (Android 13 and 14)
- Samsung bulletin ID: SVE-2024-1567, May 2025 update
- Fixed in: 14.5.10.3 (Global Android 13), 14.5.09.3 (China Android 13) or 15.5.04.5 (Android 14)
- Reported to Samsung: 7 August 2024
- CVSS: 7.2 (High), vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N - Published: 2025-05-07
Samsung describes the issue as: improper access control in Samsung Gallery prior to version 14.5.10.3 in Global Android 13, 14.5.09.3 in China Android 13, and 15.5.04.5 in Android 14 allows remote attackers to access data and perform internal operations within Samsung Gallery
Samsung says the patch adds proper verification. It does not say the flaw is exploited in the wild, and the CISA Known Exploited Vulnerabilities flag is false for this CVE.
How to check if you're exposed
Check the installed app version on the phone or tablet.
- Open Settings, then Apps, then Samsung Gallery, and scroll to the version number.
- Compare it with 14.5.10.3 (Global Android 13), 14.5.09.3 (China Android 13) or 15.5.04.5 (Android 14). Anything older is affected.
- If you manage devices, pull the app version from your mobile device management console and filter for older builds.
From a computer with USB debugging enabled you can also read the version directly. The package name below is the one commonly used for this app, so confirm it on your device first.
adb shell dumpsys package com.sec.android.gallery3d | grep versionName
Keep in mind that Samsung rates this one Moderate even though NVD scores it 7.2 High, so both numbers are worth knowing when you set priority.
What to do now
- Update Samsung Gallery through the Galaxy Store or Play Store and confirm the version is 14.5.10.3 (Global Android 13), 14.5.09.3 (China Android 13) or 15.5.04.5 (Android 14) or later.
- Turn on automatic updates for Samsung apps so the next bulletin lands without anyone remembering to act.
- If you manage a fleet, report on app versions in your MDM and push the update to devices that lag.
- Review the rest of Samsung's May 2025 bulletin, because it lists other fixes for the same cycle.
Why it matters
This record has no CWE assigned. Samsung describes it as improper access control, and says the patch adds proper verification. An entry point in the Gallery app accepts requests it should check more carefully. The record words the impact as remote access to data and internal operations within the app.
NVD scores it 7.2 because the vector is network based. Samsung's own bulletin labels it Moderate. When vendor and NVD severity differ, treat the gap as a prompt to read the vector, not as a reason to wait. The fix is the same as for its siblings: update Gallery to the fixed build for your Android release.
Quick check
Why is this High when Samsung says Moderate?
NVD scores the CVSS vector, which has a network attack path. Samsung applies its own rating. Both point to the same fix, which is to update the app.
Which version fixes it?
Samsung lists 14.5.10.3 for Global Android 13, 14.5.09.3 for China Android 13 and 15.5.04.5 for Android 14.
Sources
Last reviewed: 19 October 2026.
