EUVD-2026-29903
GHSA-hg29-fr75-r6p7
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector confirmed; no privileges needed per vendor CVSS; confidentiality impact Low reflects 'access sensitive information'; no described integrity or availability impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Incorrect privilege assignment in LocationManager prior to SMR May-2026 Release 1 allows local attackers to access sensitive information.
AnalysisAI
Incorrect privilege assignment in the LocationManager component of Samsung Mobile Devices (Android 14, 15, and 16) enables local attackers to access sensitive information without holding the requisite Android permissions. The flaw is addressed in Samsung's SMR May-2026 Release 1 security update. No public exploit code exists, EPSS stands at the 3rd percentile, and CISA has not listed this in the KEV catalog, placing it in a low-urgency category despite the broad Samsung device footprint.
Technical ContextAI
LocationManager is a core Android system service that brokers application access to device location data and related system resources. Samsung's customized Android build incorrectly assigns privileges within this component, meaning local processes can read sensitive information - most likely fine-grained location data or related system state - without holding the normally required Android permissions (e.g., ACCESS_FINE_LOCATION or ACCESS_COARSE_LOCATION). The affected CPE (cpe:2.3:a:samsung_mobile:samsung_mobile_devices:*:*:*:*:*:*:*:*) spans all Samsung Mobile Devices running Android 14, 15, and 16 prior to the May 2026 patch. No CWE is formally assigned, but the root cause maps closest to CWE-266 (Incorrect Privilege Assignment) or CWE-732 (Incorrect Permission Assignment for Critical Resource) - a class of flaws where system components grant broader access than the security model intends.
RemediationAI
Apply Samsung's SMR May-2026 Release 1 security update, which resolves the incorrect privilege assignment in LocationManager across Android 14, 15, and 16. Full advisory details are available at https://security.samsungmobile.com/securityUpdate.smsb?year=2026&month=05. Users and enterprise MDM administrators should ensure Samsung devices are enrolled in automatic security update delivery to receive the patch without delay. As a compensating control pending patch deployment, organizations managing high-sensitivity environments can restrict location permission grants to trusted applications only via Android enterprise policy or MDM profiles; this reduces the data surface accessible through the misconfigured component but does not eliminate the underlying privilege flaw. No side effects of applying the SMR May-2026 patch have been reported.
More in Samsung Mobile Devices
View allLocal privilege escalation in Samsung Galaxy Watch allows unprivileged local attackers to execute arbitrary code with sy
Stack-based buffer overflow in libril_sem.so - Samsung's Radio Interface Layer shared library - enables privileged local
We need to produce a comprehensive analysis for CVE-2026-21047. Let's gather all provided data: CVE ID, description: "Ou
Google's Secure Folder prior to the March 2026 SMR release improperly exports Android application components, enabling l
Improper access control in the Weaver component of Samsung Mobile devices allows a local attacker without elevated privi
Improper input validation in Samsung Contacts on Samsung Mobile devices prior to SMR Aug-2026 Release 1 enables local at
Unauthorized file deletion via improperly exported Android components in Samsung Contacts prior to SMR Aug-2026 Release
Incorrect privilege assignment in the Telephony component of Samsung Mobile devices prior to SMR Jun-2026 Release 1 perm
Improper permission handling in the Routines automation feature on Samsung Mobile Devices exposes sensitive information
PackageManagerService on Samsung Mobile Devices running Android 14, 15, and 16 allows local attackers without elevated p
AppLock on Samsung Mobile Devices prior to SMR Aug-2026 Release 1 exposes improperly exported Android application compon
Out-of-bounds memory write in Samsung's SveService component allows local attackers holding high privileges to execute a
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today