EUVD-2026-29906
GHSA-wv49-fmc3-hf27
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector with PR:N because any co-resident Android app can send intents to exported components without elevated privileges; low C/I/A impacts reflect partial, bounded effect on device configuration data.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Improper export of android application components in OmaCP prior to SMR May-2026 Release 1 allows local attackers to trigger privileged functions.
AnalysisAI
OmaCP on Samsung Android devices (Android 14, 15, and 16) exposes improperly exported application components that allow any co-resident local application to invoke privileged functions without holding the required permissions. The flaw is rooted in Android's IPC mechanism, where components lacking proper access control declarations can be targeted by crafted intents from other installed apps. No public exploit code has been identified at the time of analysis, and EPSS sits at 0.01% (3rd percentile), consistent with SSVC's exploitation status of none; risk is real but bounded by the local attack vector.
Technical ContextAI
OmaCP is a Samsung Mobile application implementing OMA (Open Mobile Alliance) Client Provisioning, used to push and apply carrier-side device configuration - a function with access to sensitive provisioning operations. Android application components (Activities, Services, BroadcastReceivers, ContentProviders) may be declared as exported via android:exported='true' or by including an intent-filter without an android:permission guard, making them reachable by any app on the device. Without proper permission enforcement on these components, a malicious co-resident app can dispatch crafted intents to trigger privileged provisioning or configuration functions. This vulnerability class maps to CWE-926 (Improper Export of Android Application Components), though no CWE is formally assigned in the NVD entry. The CPE is cpe:2.3:a:samsung_mobile:samsung_mobile_devices:*:*:*:*:*:*:*:*, and the 'Google' tag suggests coordinated disclosure potentially involving Android's security team.
RemediationAI
Apply Samsung's SMR May-2026 Release 1, which patches the improper component export in OmaCP for Android 14, 15, and 16. Device owners should verify the May 2026 security patch level is applied via Settings > Software Update or Settings > About Phone > Software Information. Enterprise administrators managing Samsung fleets should confirm patch deployment through their Mobile Device Management (MDM) solution. As a compensating control before patching, restrict installation of untrusted third-party applications using MDM policies or Google Play Protect enforcement - this reduces the likelihood of a malicious app being present to exploit the exported component, though it does not eliminate the underlying flaw. Full vendor advisory details are at https://security.samsungmobile.com/securityUpdate.smsb?year=2026&month=05.
More in Samsung Mobile Devices
View allLocal privilege escalation in Samsung Galaxy Watch allows unprivileged local attackers to execute arbitrary code with sy
Stack-based buffer overflow in libril_sem.so - Samsung's Radio Interface Layer shared library - enables privileged local
We need to produce a comprehensive analysis for CVE-2026-21047. Let's gather all provided data: CVE ID, description: "Ou
Improper access control in the Weaver component of Samsung Mobile devices allows a local attacker without elevated privi
Improper input validation in Samsung Contacts on Samsung Mobile devices prior to SMR Aug-2026 Release 1 enables local at
Unauthorized file deletion via improperly exported Android components in Samsung Contacts prior to SMR Aug-2026 Release
Incorrect privilege assignment in the Telephony component of Samsung Mobile devices prior to SMR Jun-2026 Release 1 perm
Improper permission handling in the Routines automation feature on Samsung Mobile Devices exposes sensitive information
PackageManagerService on Samsung Mobile Devices running Android 14, 15, and 16 allows local attackers without elevated p
AppLock on Samsung Mobile Devices prior to SMR Aug-2026 Release 1 exposes improperly exported Android application compon
Out-of-bounds memory write in Samsung's SveService component allows local attackers holding high privileges to execute a
External control of file name in Samsung AODManager prior to April 2026 SMR Release 1 allows privileged local attackers
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today