What is the CVSS score of CVE-2026-20989?

CVE-2026-20989 has a CVSS 3.1 base score of 2.4 (Low). CVSS vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Jwt Attack are affected by CVE-2026-20989?

CVE-2026-20989 is a low-severity vulnerability in Font Settings (CVSS 2.4). The limited severity suggests constrained impact, typically requiring specific conditions or local access for exploitation.

How to fix or mitigate CVE-2026-20989?

During next maintenance window: Apply vendor patches when convenient. Monitor vendor channels for updates.

Jwt Attack CVE-2026-20989

EUVD-2026-12295 LOW

Improper Verification of Cryptographic Signature (CWE-347)

2026-03-16 SamsungMobile

Information Disclosure Jwt Attack

2.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

2.4 LOW

AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 16, 2026 - 05:00 euvd

EUVD-2026-12295

Analysis Generated

Mar 16, 2026 - 05:00 vuln.today

CVE Published

Mar 16, 2026 - 04:31 nvd

LOW 2.4

DescriptionCVE.org

Improper verification of cryptographic signature in Font Settings prior to SMR Mar-2026 Release 1 allows physical attackers to use custom font.

AnalysisAI

This vulnerability involves improper cryptographic signature verification in the Font Settings component of Samsung devices prior to the March 2026 Security Update Release 1. A physical attacker can bypass signature validation to install custom fonts, potentially leading to integrity compromise of system font resources. While the CVSS score is moderate at 5.1, the attack requires physical access and user interaction, limiting real-world exploitation frequency.

Technical ContextAI

The vulnerability exists in Samsung's Font Settings application, which manages system font installation and validation. The root cause is insufficient cryptographic signature verification (related to improper input validation and authentication weaknesses) when processing font files. Samsung devices use a signed font verification mechanism to ensure only authorized fonts are loaded into the system; this mechanism is bypassable through crafted font files that do not pass proper signature checks. The affected technology spans Samsung's font management subsystem across multiple device models running Android-based operating systems prior to the March 2026 security patch release. The weakness allows an attacker with physical device access to substitute legitimate fonts with malicious or custom variants without proper cryptographic validation.

RemediationAI

Apply the Samsung March 2026 Security Update Release 1 (SMR Mar-2026 Release 1) or any subsequent security patch to your Samsung device immediately. Navigate to Settings > About Phone > Software Updates and install the latest available security patch. Until patching is completed, physical security controls should be emphasized: avoid leaving devices unattended with unlocked screens, use biometric or PIN-based device locks, and educate users about the risks of allowing unknown parties to access their devices. Samsung has published patch availability and detailed instructions via their official security advisory at https://security.samsungmobile.com/