EUVD-2026-21864Severity by source
AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
Improper input validation in Retail Mode prior to SMR Apr-2026 Release 1 allows local attackers to trigger privileged functions.
AnalysisAI
Improper input validation in Samsung Mobile Retail Mode prior to SMR April 2026 Release 1 allows local attackers with limited privileges to trigger privileged functions, potentially leading to information disclosure and unauthorized modification of device state. The vulnerability requires physical or local access and low-privilege credentials, limiting immediate remote exploitation risk but posing significant concern for retail environments where devices are physically accessible to untrusted parties.
Technical ContextAI
The vulnerability resides in Samsung Mobile's Retail Mode functionality, a special operational state designed for in-store demonstrations and testing. Retail Mode typically operates with elevated privileges to facilitate rapid device configuration and feature showcasing. The improper input validation flaw permits bypass of privilege boundary checks, allowing a local attacker with limited user privileges (PR:L) to invoke functions normally restricted to system or administrative accounts. The root cause is classified under input validation deficiencies, suggesting the Retail Mode subsystem fails to adequately sanitize or validate user-supplied input before processing commands that should require higher privilege levels. The affected CPE encompasses Samsung Mobile devices across all versions prior to the April 2026 Security Maintenance Release (SMR) batch 1.
RemediationAI
Vendor-released patch: Samsung Mobile SMR April 2026 Release 1 and later. Affected users must update their Samsung Mobile devices to the April 2026 SMR patch or a more recent security release. No workarounds are available for this privilege escalation vulnerability; patching is the only remediation path. Users should check Samsung Mobile's security update portal at https://security.samsungmobile.com/securityUpdate.smsb?year=2026&month=04 for device-specific patch availability and installation instructions. Organizations managing retail or demo devices should prioritize patching to prevent unauthorized access to sensitive device configuration and data.
More in Samsung Mobile Devices
View allOut-of-bounds write in Samsung's Keymaster trustlet - a Trusted Execution Environment (TEE) component running in ARM Tru
Local privilege escalation to root in Samsung's DualDAR (Dual Data-at-Rest) encryption component affects Samsung mobile
Remote code execution in Samsung Mobile Devices arises from a heap-based buffer overflow in the JPEG decoding path of li
Remote code execution in the DNG (Adobe Digital Negative) image decoder within Samsung's Quram imaging library (libimage
Path traversal in Samsung's ImsService (IP Multimedia Subsystem Service) on Android 14 through 17 permits remote unauthe
Out-of-bounds write in libmdnie.so on Samsung Mobile Devices running Android 15, 16, and 17 enables local attackers to e
Local privilege escalation in Samsung Galaxy Watch allows unprivileged local attackers to execute arbitrary code with sy
Stack-based buffer overflow in libril_sem.so - Samsung's Radio Interface Layer shared library - enables privileged local
Improper input validation in Samsung's DualDAR kernel driver enables a local privileged attacker to escalate privileges
Memory corruption in Samsung's proprietary ImsService - the IP Multimedia Subsystem component handling VoLTE, Wi-Fi Call
Google's Secure Folder prior to the March 2026 SMR release improperly exports Android application components, enabling l
Heap buffer overflow in Samsung KnoxVault trustlet (hwvault trusted application) on Samsung Mobile Devices prior to SMR
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today