EUVD-2026-34800
GHSA-v9qf-4h48-3vcg
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (SamsungMobile).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Improper access control in AuditLogService prior to SMR Jun-2026 Release 1 allows local attackers to access sensitive information.
AnalysisAI
Improper access control in the AuditLogService component of Samsung Mobile Devices running Android 16 exposes sensitive audit log information to local attackers. The flaw, disclosed and patched by Samsung Mobile as part of their June 2026 Security Maintenance Release (SMR Jun-2026 Release 1), enables a local attacker without special privileges to both read and potentially modify sensitive data surfaced by the audit logging subsystem. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Technical ContextAI
AuditLogService is a privileged system service within the Samsung Android software stack, responsible for recording and managing audit log events on the device. The vulnerability stems from improper access control - specifically, the service fails to adequately restrict which calling contexts or user-space processes can interact with or retrieve audit data it manages. The CPE (cpe:2.3:a:samsung_mobile:samsung_mobile_devices:*:*:*:*:*:*:*:*) broadly covers Samsung Mobile Devices without pinning to a specific hardware model, indicating the issue is in Samsung's Android software layer rather than device firmware. No CWE identifier was assigned in the provided data, but the behavioral description maps conceptually to CWE-284 (Improper Access Control) or CWE-732 (Incorrect Permission Assignment for Critical Resource). The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:N) confirms local, low-complexity exploitation requiring no prior privileges or user interaction.
RemediationAI
Apply the Samsung Security Maintenance Release SMR Jun-2026 Release 1 for Android 16, which contains the fix for this vulnerability as confirmed by Samsung Mobile and documented under EUVD-2026-34800. Users and enterprise administrators should ensure devices are updated to this release or later via OTA update or device management policy. The Samsung Mobile Security Advisory at https://security.samsungmobile.com/securityUpdate.smsb?year=2026&month=06 should be consulted for exact build identifiers and device-specific rollout timelines. As a compensating control prior to patching, organizations with mobile device management (MDM) solutions should audit which applications hold permissions enabling local service interaction, and consider restricting sideloaded or untrusted application installation to reduce the local attacker foothold prerequisite. No workaround that eliminates the vulnerability without patching has been identified from available data.
More in Samsung Mobile Devices
View allOut-of-bounds write in Samsung's Keymaster trustlet - a Trusted Execution Environment (TEE) component running in ARM Tru
Local privilege escalation to root in Samsung's DualDAR (Dual Data-at-Rest) encryption component affects Samsung mobile
Remote code execution in Samsung Mobile Devices arises from a heap-based buffer overflow in the JPEG decoding path of li
Remote code execution in the DNG (Adobe Digital Negative) image decoder within Samsung's Quram imaging library (libimage
Path traversal in Samsung's ImsService (IP Multimedia Subsystem Service) on Android 14 through 17 permits remote unauthe
Out-of-bounds write in libmdnie.so on Samsung Mobile Devices running Android 15, 16, and 17 enables local attackers to e
Local privilege escalation in Samsung Galaxy Watch allows unprivileged local attackers to execute arbitrary code with sy
Stack-based buffer overflow in libril_sem.so - Samsung's Radio Interface Layer shared library - enables privileged local
Improper input validation in Samsung's DualDAR kernel driver enables a local privileged attacker to escalate privileges
We need to produce a comprehensive analysis for CVE-2026-21047. Let's gather all provided data: CVE ID, description: "Ou
Google's Secure Folder prior to the March 2026 SMR release improperly exports Android application components, enabling l
Heap buffer overflow in Samsung KnoxVault trustlet (hwvault trusted application) on Samsung Mobile Devices prior to SMR
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today