What’s Vulnerable › Vulnerabilities

CVE-2025-27839

• Severity: low (CVSS 3.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-03-08 · updated 2026-06-17
• Weakness: CWE-1025

Description

operations/attestation/AttestationTask.kt in the Tangem SDK before 5.18.3 for Android has a logic flow in offline wallet attestation (genuineness check) that causes verification results to be disregarded during the first scan of a card. Exploitation may not have been possible.

Affected products

• Tangem SDK: before 5.18.3 — fixed in 5.18.3

How to fix

Upgrade to a fixed version: Tangem SDK 5.18.3. Check the vendor advisory for mitigations.

References

• https://github.com/tangem/tangem-sdk-android/commit/24588188fdb51ed469cd59d2c595128c1fe63b07
• https://github.com/tangem/tangem-sdk-android/releases/tag/release-app_5.18-409
• https://tangem.com/en/blog/post/app-update/

Get alerted when CVE-2025-27839 or the next vulnerability affects your stack