Samsung Assistant CVE-2026-20993

The CVSS 4.0 score of 4.8 reflects the following risk signals: Attack Vector is Local (AV:L), meaning an attacker must already have code execution or local system access; Attack Complexity is Low (AC:L), requiring no special conditions; Privileges Required are Low (PR:L), requiring a basic user or app context; User Interaction is None (UI:N); and the impact is limited to Integrity (VI:L) and Availability (VA:L) with no Confidentiality impact noted in the vector, though the description explicitly mentions 'access to saved information' which suggests information disclosure. Real-world risk is moderate: the local-only attack vector significantly reduces exploitability compared to network-based vulnerabilities, and the requirement for low privilege access means exploitation requires either physical device access or installation of a malicious application. Without KEV (Known Exploited Vulnerability) status, active POC, or reported exploitation in the wild, this is not an emergency, but it should be prioritized for devices handling sensitive personal information. The EPSS score is not provided, but the moderate CVSS combined with local-only attack vector suggests this is a real but not critical priority for most enterprises.

A malicious application installed on a Samsung device (either sideloaded or downloaded from a third-party store) queries the exported, unprotected components of Samsung Assistant to extract sensitive saved user information such as voice history, personal settings, or other data stored by the assistant. Because the Samsung Assistant component is improperly exported without access control enforcement, the malicious app successfully retrieves this information without triggering any permission prompts or security mechanisms. The attack requires only local access (the malicious app is already installed or run by the device owner) and low complexity to execute, making it a practical threat if a user installs compromised software or if a device is briefly compromised via USB debugging or physical access.