Samsung's KNOX security framework contained a high-severity use-after-free vulnerability that remained undiscovered for eight years, potentially exposing millions of Galaxy devices to kernel attacks. The flaw affected Android-powered Galaxy models from the S9 through the S25 series.
The vulnerability's severity is underscored by its longevity and the breadth of affected devices. Researchers disclosed the flaw after it had existed in the KNOX framework for nearly a decade, though a specific CVSS score was not provided in available reports. The attack surface encompasses a significant portion of Samsung's flagship lineup over the past eight years.
At a technical level, the issue is a use-after-free bug within the KNOX security framework, allowing an attacker to achieve kernel-level access. Such a flaw can enable complete control over the affected device including data access and persistent compromise.
Samsung has addressed the vulnerability with patches. Galaxy users are urged to apply the latest security updates to mitigate the risk. Timelines for patch distribution may vary by carrier and region.
Attribution of the discovery was not disclosed in available sources. This flaw highlights the challenge of hardening deeply embedded security frameworks across years of device iterations.