Samsung Telephony CVE-2026-21025

Local access to the device is required (AV:L), meaning the attacker must either have physical access, an installed malicious application, or an existing foothold via another vulnerability. PR:N in CVSS 4.0 indicates no prior privileges are required - a standard user-level app or unprivileged local process is sufficient. No user interaction is required (UI:N) once the attacker has local access. Exploitation is limited to devices running Android 14, 15, or 16 on the Samsung platform that have not yet received SMR Jun-2026 Release 1. Remote exploitation over a network is not possible given the local attack vector. There is no indication that a specific non-default configuration is required - the flaw appears to affect the default Telephony component state on unpatched firmware.

Samsung-assigned CVSS 4.0 base score of 6.9 (Medium). The vector AV:L/AC:L/AT:N/PR:N/UI:N indicates local access with low complexity, no additional attack requirements, no privileges needed, and no user interaction - conditions that are relatively easy to meet for any app or user with device access. However, a material discrepancy exists between the CVSS metrics and the CVE description: the description identifies an information disclosure impact (confidentiality), yet the CVSS 4.0 metrics record VC:N (no confidentiality impact on the vulnerable system) and VA:H (high availability impact). These signals are contradictory and should be verified against the Samsung advisory. EPSS data is not provided, preventing probabilistic exploitation forecasting. The CVE is not in CISA KEV, and no public exploit code has been identified. Overall real-world risk is moderate and localized - exploitation requires physical possession of or code execution on the target device, limiting mass exploitation potential despite low attack complexity.

A malicious application installed on an unpatched Samsung device, or a local user with shell access, invokes Telephony APIs that should require elevated permissions but are incorrectly accessible due to the privilege misassignment. The attacker reads sensitive telephony data - such as call logs, IMSI/IMEI identifiers, or network registration state - without needing any special system privileges. No public exploit code has been identified at time of analysis, but the low attack complexity means this scenario requires minimal technical skill once local access is established.