EUVD-2026-21872
GHSA-mjx3-57hm-4rw6
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
5DescriptionCVE.org
Improper access control in Samsung Camera prior to version 16.5.00.28 allows local attacker to access location data. User interaction is required for triggering this vulnerability.
AnalysisAI
Samsung Camera prior to version 16.5.00.28 allows local attackers with limited privileges to access device location data through improper access control, requiring user interaction to trigger. This information disclosure vulnerability affects Samsung's mobile camera application and represents a localized privacy exposure on affected devices.
Technical ContextAI
The vulnerability stems from inadequate access control mechanisms within Samsung Camera's handling of location data access. The affected component fails to properly restrict access to location information when invoked by processes with limited user privileges (PR:L in CVSS vector). The attack requires local system access (AV:L) and user interaction (UI:A), indicating the attacker must already have presence on the device and potentially require user action to trigger data exposure. This is classified as an information disclosure vulnerability affecting confidentiality (VC:H) without integrity or availability impact.
RemediationAI
Samsung has released a patched version: upgrade Samsung Camera to version 16.5.00.28 or later. Users should install this update through the Samsung Galaxy Store or automatic update mechanisms on their mobile devices. No workarounds are available to mitigate the access control flaw without applying the official patch. Complete advisory information and technical details are provided by Samsung Mobile Security at https://security.samsungmobile.com/serviceWeb.smsb?year=2026&month=04.
Arbitrary file write as SYSTEM in Samsung MagicINFO 9 Server before version 21.1050 allows remote attackers to place att
Samsung MagicINFO 9 Server contains a path traversal vulnerability allowing unauthenticated attackers to write arbitrary
Multiple stack-based buffer overflows in the BackupToAvi method in the (1) UMS_Ctrl 1.5.1.1 and (2) UMS_Ctrl_STW 2.0.1.0
Web Viewer 1.0.0.193 on Samsung SRN-1670D devices suffers from an Unrestricted file upload vulnerability: 'network_ssl_u
Web Viewer 1.0.0.193 on Samsung SRN-1670D devices allows remote attackers to read arbitrary files via a request to an un
Samsung Internet Browser 5.4.02.3 allows remote attackers to bypass the Same Origin Policy and obtain sensitive informat
Buffer overflow in the PrepareSync method in the SyncService.dll ActiveX control in Samsung Kies before 2.5.1.12123_2_7
The Samsung D6000 TV and possibly other products allow remote attackers to cause a denial of service (continuous restart
The Samsung D6000 TV and possibly other products allows remote attackers to cause a denial of service (crash) via a long
The ConnectDDNS method in the (1) STWConfigNVR 1.1.13.15 and (2) STWConfig 1.1.14.13 ActiveX controls in Samsung NET-i v
Multiple directory traversal vulnerabilities in Samsung SyncThru 6 before 1.0 allow remote attackers to delete arbitrary
Stack-based buffer overflow in the RequestScreenOptimization function in the XProcessControl.ocx ActiveX control in msls
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today