EUVD-2026-29907
GHSA-rfpf-6h77-7xh3
Severity by source
CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Physical vector required per description and CVSS 4.0 AV:P; no confidentiality or integrity impact confirmed; availability impact high per VA:H mapping.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Improper input validation in Routines prior to SMR May-2026 Release 1 allows physical attackers to launch privileged activity.
AnalysisAI
Improper input validation in the Routines feature on Samsung Mobile Devices (Android 16) enables a physical attacker to launch privileged activities outside normal authorization boundaries. Affected devices are those running any build prior to SMR May-2026 Release 1, as confirmed by Samsung Mobile Security. No public exploit exists at time of analysis, and EPSS at 0.04% (13th percentile) reflects the negligible likelihood of widespread exploitation given the mandatory physical access requirement.
Technical ContextAI
Routines is a Samsung-developed automation feature present on Samsung Mobile Devices that allows users to define conditional triggers and automated device behaviors. The vulnerability involves improper input validation within this feature, meaning the application fails to sufficiently sanitize or constrain attacker-supplied input, resulting in unintended execution of privileged system activities. No CWE was assigned by the reporter, limiting formal root-cause classification. The CPE string cpe:2.3:a:samsung_mobile:samsung_mobile_devices:*:*:*:*:*:*:*:* covers the full Samsung Mobile Devices product line without version granularity beyond the patch boundary of SMR May-2026 Release 1 on Android 16. The CVSS 4.0 vector AV:P confirms that exploitation is constrained to physical proximity; no network-reachable code path has been identified.
RemediationAI
Apply the vendor-released patch SMR May-2026 Release 1 for Android 16, delivered via Samsung's monthly security update mechanism. Consult the Samsung Mobile Security advisory at https://security.samsungmobile.com/securityUpdate.smsb?year=2026&month=05 for device-specific rollout timelines. For devices pending the update, the primary compensating control is enforcing physical device security: ensuring devices are not left unattended and enabling screen lock with strong authentication, which raises the bar for physical attackers attempting to interact with the Routines interface. Disabling or restricting the Routines feature may serve as an additional workaround but would impact automation functionality; Samsung's advisory should be consulted for official interim guidance. No remote network mitigations are applicable given the physical attack vector.
More in Samsung Mobile Devices
View allLocal privilege escalation in Samsung Galaxy Watch allows unprivileged local attackers to execute arbitrary code with sy
Stack-based buffer overflow in libril_sem.so - Samsung's Radio Interface Layer shared library - enables privileged local
We need to produce a comprehensive analysis for CVE-2026-21047. Let's gather all provided data: CVE ID, description: "Ou
Improper access control in the Weaver component of Samsung Mobile devices allows a local attacker without elevated privi
Improper input validation in Samsung Contacts on Samsung Mobile devices prior to SMR Aug-2026 Release 1 enables local at
Unauthorized file deletion via improperly exported Android components in Samsung Contacts prior to SMR Aug-2026 Release
Incorrect privilege assignment in the Telephony component of Samsung Mobile devices prior to SMR Jun-2026 Release 1 perm
Improper permission handling in the Routines automation feature on Samsung Mobile Devices exposes sensitive information
PackageManagerService on Samsung Mobile Devices running Android 14, 15, and 16 allows local attackers without elevated p
AppLock on Samsung Mobile Devices prior to SMR Aug-2026 Release 1 exposes improperly exported Android application compon
Out-of-bounds memory write in Samsung's SveService component allows local attackers holding high privileges to execute a
External control of file name in Samsung AODManager prior to April 2026 SMR Release 1 allows privileged local attackers
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today