EUVD-2026-29905
GHSA-mwvv-x94p-96gq
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
Improper input validation in FacAtFunction in Galaxy Watch prior to SMR May-2026 Release 1 allows local attacker to execute arbitrary code with system privilege.
AnalysisAI
Local privilege escalation in Samsung Galaxy Watch allows unprivileged local attackers to execute arbitrary code with system-level privileges by exploiting improper input validation in the FacAtFunction component. Affects Galaxy Watch devices running Android Watch 14 and 16 prior to Samsung's May 2026 security release (SMR May-2026 Release 1). EPSS score of 0.03% indicates low automated exploitation probability, and no active exploitation or public POC has been identified at time of analysis. Attack requires physical or ADB access to the device.
Technical ContextAI
The vulnerability resides in FacAtFunction, a Samsung-specific component in the Galaxy Watch firmware that appears to handle AT command processing or factory testing functions. The flaw stems from improper input validation - a class of vulnerabilities where user-supplied data is not sufficiently sanitized before being processed by privileged system functions. The CVSS 4.0 vector (AV:L/AC:L/PR:N) indicates local access with low attack complexity and no privileges required, suggesting the vulnerable function is accessible to unprivileged processes or through debugging interfaces like ADB. The affected platform is Samsung's Android-based wearable OS (Wear OS variants for Android Watch 14 and 16), which runs a modified Android stack with Samsung proprietary components. CPE data identifies the vulnerability scope as Samsung Mobile Devices ecosystem, specifically the Galaxy Watch product line.
RemediationAI
Apply Samsung Mobile Security Release May 2026 Release 1 or later through the Galaxy Wearable app on paired smartphones or via direct device system update (Settings > Software update > Download and install). Samsung distributes wearable OS updates through staged rollout, so availability varies by region and carrier. Users can check current security patch level in Settings > About watch > Software information > Security software version - must show May 2026 or later. Until patched, compensating controls include: disable USB debugging in Developer options to prevent ADB-based exploitation (trade-off: limits legitimate development and troubleshooting); restrict installation of apps to Galaxy Store only via Settings > Apps > App permissions > Special access > Install unknown apps (reduces malicious app vector but blocks sideloading); enable PIN/password device lock to prevent unauthorized physical access (does not protect against exploit via malicious app but raises attack complexity). No workaround fully mitigates the vulnerability - patching is the only complete remediation.
More in Samsung Mobile Devices
View allStack-based buffer overflow in libril_sem.so - Samsung's Radio Interface Layer shared library - enables privileged local
We need to produce a comprehensive analysis for CVE-2026-21047. Let's gather all provided data: CVE ID, description: "Ou
Improper access control in the Weaver component of Samsung Mobile devices allows a local attacker without elevated privi
Improper input validation in Samsung Contacts on Samsung Mobile devices prior to SMR Aug-2026 Release 1 enables local at
Unauthorized file deletion via improperly exported Android components in Samsung Contacts prior to SMR Aug-2026 Release
Incorrect privilege assignment in the Telephony component of Samsung Mobile devices prior to SMR Jun-2026 Release 1 perm
Improper permission handling in the Routines automation feature on Samsung Mobile Devices exposes sensitive information
PackageManagerService on Samsung Mobile Devices running Android 14, 15, and 16 allows local attackers without elevated p
AppLock on Samsung Mobile Devices prior to SMR Aug-2026 Release 1 exposes improperly exported Android application compon
Out-of-bounds memory write in Samsung's SveService component allows local attackers holding high privileges to execute a
External control of file name in Samsung AODManager prior to April 2026 SMR Release 1 allows privileged local attackers
FactoryCamera on Samsung Mobile Devices prior to SMR May-2026 Release 1 exposes a unique device identifier to local low-
Share
External POC / Exploit Code
Leaving vuln.today