ZDI 2026-03-23

ZDI-26-223: (Pwn2Own) Samsung Galaxy S25 Smart Touch Call Application Protection Mechanism Failure Information Disclosure Vulnerability

CVE-2025-58488

Machine-generated analysis · WAYSCloud LLM

The vulnerability requires user interaction, such as visiting a malicious page or opening a malicious file, to disclose sensitive information on the Samsung Galaxy S25.

Context

The affected product is the Samsung Galaxy S25, specifically involving the Smart Touch Call application. The vulnerability is an information disclosure issue stemming from a protection mechanism failure. The advisory notes that remote attackers can exploit this condition to disclose sensitive information. Worth noting is that the CVSS score is rated at 5.9, indicating a moderate severity level.

Operator considerations

Check: Verify if the Samsung Galaxy S25 devices in use have the Smart Touch Call application installed and active.

From Zero Day Initiative ↗

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Samsung Galaxy S25. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 5.9. The following CVEs are assigned: CVE-2025-58488.

Read the full advisory on ZDI →