EUVD-2026-29903
GHSA-hg29-fr75-r6p7
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector confirmed; no privileges needed per vendor CVSS; confidentiality impact Low reflects 'access sensitive information'; no described integrity or availability impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Incorrect privilege assignment in LocationManager prior to SMR May-2026 Release 1 allows local attackers to access sensitive information.
AnalysisAI
Incorrect privilege assignment in the LocationManager component of Samsung Mobile Devices (Android 14, 15, and 16) enables local attackers to access sensitive information without holding the requisite Android permissions. The flaw is addressed in Samsung's SMR May-2026 Release 1 security update. No public exploit code exists, EPSS stands at the 3rd percentile, and CISA has not listed this in the KEV catalog, placing it in a low-urgency category despite the broad Samsung device footprint.
Technical ContextAI
LocationManager is a core Android system service that brokers application access to device location data and related system resources. Samsung's customized Android build incorrectly assigns privileges within this component, meaning local processes can read sensitive information - most likely fine-grained location data or related system state - without holding the normally required Android permissions (e.g., ACCESS_FINE_LOCATION or ACCESS_COARSE_LOCATION). The affected CPE (cpe:2.3:a:samsung_mobile:samsung_mobile_devices:*:*:*:*:*:*:*:*) spans all Samsung Mobile Devices running Android 14, 15, and 16 prior to the May 2026 patch. No CWE is formally assigned, but the root cause maps closest to CWE-266 (Incorrect Privilege Assignment) or CWE-732 (Incorrect Permission Assignment for Critical Resource) - a class of flaws where system components grant broader access than the security model intends.
RemediationAI
Apply Samsung's SMR May-2026 Release 1 security update, which resolves the incorrect privilege assignment in LocationManager across Android 14, 15, and 16. Full advisory details are available at https://security.samsungmobile.com/securityUpdate.smsb?year=2026&month=05. Users and enterprise MDM administrators should ensure Samsung devices are enrolled in automatic security update delivery to receive the patch without delay. As a compensating control pending patch deployment, organizations managing high-sensitivity environments can restrict location permission grants to trusted applications only via Android enterprise policy or MDM profiles; this reduces the data surface accessible through the misconfigured component but does not eliminate the underlying privilege flaw. No side effects of applying the SMR May-2026 patch have been reported.
More in Samsung Mobile Devices
View allOut-of-bounds write in Samsung's Keymaster trustlet - a Trusted Execution Environment (TEE) component running in ARM Tru
Local privilege escalation to root in Samsung's DualDAR (Dual Data-at-Rest) encryption component affects Samsung mobile
Remote code execution in Samsung Mobile Devices arises from a heap-based buffer overflow in the JPEG decoding path of li
Remote code execution in the DNG (Adobe Digital Negative) image decoder within Samsung's Quram imaging library (libimage
Path traversal in Samsung's ImsService (IP Multimedia Subsystem Service) on Android 14 through 17 permits remote unauthe
Out-of-bounds write in libmdnie.so on Samsung Mobile Devices running Android 15, 16, and 17 enables local attackers to e
Local privilege escalation in Samsung Galaxy Watch allows unprivileged local attackers to execute arbitrary code with sy
Stack-based buffer overflow in libril_sem.so - Samsung's Radio Interface Layer shared library - enables privileged local
Improper input validation in Samsung's DualDAR kernel driver enables a local privileged attacker to escalate privileges
We need to produce a comprehensive analysis for CVE-2026-21047. Let's gather all provided data: CVE ID, description: "Ou
Google's Secure Folder prior to the March 2026 SMR release improperly exports Android application components, enabling l
Heap buffer overflow in Samsung KnoxVault trustlet (hwvault trusted application) on Samsung Mobile Devices prior to SMR
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today