SecTelephonyProvider CVE-2026-21017

Exploitation requires that the attacker have local access to the Samsung device - either through a locally installed application or physical access to an unlocked device. The CVSS 4.0 PR:N value confirms no elevated device privileges (e.g., root or system-level access) are needed, but UI:A confirms that a victim user must actively interact with the attacker-controlled application or component for exploitation to succeed; passive background execution is not sufficient. The vulnerability is limited to Samsung Mobile Devices running Android 14, 15, or 16 prior to SMR Jun-2026 Release 1 - devices on Android 13 or earlier, or those already patched to Jun-2026, are not affected per available data. Exploitation is bounded to low-impact access to SecTelephonyProvider's privileged files; no privilege escalation to system or root, no remote execution, and no cross-application scope change are indicated by the CVSS vector.

The CVSS 4.0 base score of 4.6 (Medium) is consistent with the constrained threat model: attack vector is local (AV:L), ruling out remote exploitation, and active user interaction is required (UI:A), which significantly reduces the likelihood of opportunistic or automated exploitation. Notably, PR:N indicates the attacker does not need elevated device privileges, lowering the bar for local exploitation once interaction is achieved - for example, via a malicious sideloaded app. Impact is assessed as low across confidentiality, integrity, and availability (VC:L/VI:L/VA:L) with no scope change to subsequent systems (SC:N/SI:N/SA:N). No EPSS data was provided, no CISA KEV listing exists, and no public POC has been identified, all of which align with the moderate CVSS score and suggest this is not a high-priority emergency patch. There is no apparent conflict between the CVSS vector and the description - local access and user interaction requirements are consistent with the improper privilege check scenario in a telephony provider. This is a real but low-urgency vulnerability, most relevant to enterprise MDM environments managing Samsung fleets or threat models involving malicious apps.

An attacker distributes a malicious Android application that, once installed on a Samsung device running an unpatched Android 14, 15, or 16 build, induces the user to interact with it (satisfying the UI:A requirement). Upon interaction, the app invokes SecTelephonyProvider with a crafted request that bypasses the insufficient privilege check, gaining read or write access to telephony-related privileged files such as call records or provider configuration data. No public proof-of-concept has been identified at time of analysis, and the local-only attack vector limits the scenario to targeted attacks involving device access or malicious app distribution.