EUVD-2026-21868
GHSA-ff89-7r94-6q4q
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
External control of file name in AODManager prior to SMR Apr-2026 Release 1 allows privileged local attacker to create file with system privilege.
AnalysisAI
External control of file name in Samsung AODManager prior to April 2026 SMR Release 1 allows privileged local attackers to create files with system privileges, potentially leading to privilege escalation or system compromise. The vulnerability requires high-level local privileges and affects Samsung Mobile devices through a path traversal or file name manipulation flaw in the AODManager component. No public exploit code has been identified at the time of analysis.
Technical ContextAI
AODManager is a Samsung system component responsible for managing Always-On Display functionality in Samsung Mobile devices. The vulnerability stems from improper validation of file name inputs, allowing an attacker with high-level local privileges to bypass file creation restrictions and write files with elevated system privileges. This is a classic external control of file name vulnerability (path traversal or insecure temporary file creation variant), where user-supplied or attacker-controlled input is used directly in file operations without proper sanitization. The flaw exists in the system-level service that handles display management operations, making it particularly dangerous as it operates with system-level context.
RemediationAI
Users should apply the Samsung Security Maintenance Release for April 2026 Release 1 or later, which contains the fix for the AODManager external file name control vulnerability. This update should be applied to all affected Samsung Mobile devices as soon as it becomes available. The patch can be obtained through Samsung's official security update portal at https://security.samsungmobile.com/securityUpdate.smsb?year=2026&month=04. No interim workarounds are applicable given the system-level nature of the AODManager component; patching is the primary remediation path. Users with devices not yet eligible for the April 2026 SMR should monitor Samsung's security advisory for their specific device model's update timeline.
More in Samsung Mobile Devices
View allOut-of-bounds write in Samsung's Keymaster trustlet - a Trusted Execution Environment (TEE) component running in ARM Tru
Local privilege escalation to root in Samsung's DualDAR (Dual Data-at-Rest) encryption component affects Samsung mobile
Remote code execution in Samsung Mobile Devices arises from a heap-based buffer overflow in the JPEG decoding path of li
Remote code execution in the DNG (Adobe Digital Negative) image decoder within Samsung's Quram imaging library (libimage
Path traversal in Samsung's ImsService (IP Multimedia Subsystem Service) on Android 14 through 17 permits remote unauthe
Out-of-bounds write in libmdnie.so on Samsung Mobile Devices running Android 15, 16, and 17 enables local attackers to e
Local privilege escalation in Samsung Galaxy Watch allows unprivileged local attackers to execute arbitrary code with sy
Stack-based buffer overflow in libril_sem.so - Samsung's Radio Interface Layer shared library - enables privileged local
Improper input validation in Samsung's DualDAR kernel driver enables a local privileged attacker to escalate privileges
We need to produce a comprehensive analysis for CVE-2026-21047. Let's gather all provided data: CVE ID, description: "Ou
Google's Secure Folder prior to the March 2026 SMR release improperly exports Android application components, enabling l
Heap buffer overflow in Samsung KnoxVault trustlet (hwvault trusted application) on Samsung Mobile Devices prior to SMR
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today