EUVD-2026-34801
GHSA-h2jf-5w74-2mg5
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (SamsungMobile).
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
Improper export of android application components in Galaxy Editing Service prior to SMR Jun-2026 Release 1 allows local attacker to execute privileged operations.
AnalysisAI
Improper Android component export in Samsung's Galaxy Editing Service exposes privileged operations to local, low-privileged attackers on Android 14, 15, and 16 devices prior to SMR Jun-2026 Release 1. A malicious app installed on the device can directly invoke these exported components - bypassing intended permission controls - to execute operations with elevated privileges, resulting in high integrity impact on the vulnerable system. No public exploit identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog.
Technical ContextAI
Android application components - Activities, Services, BroadcastReceivers, and ContentProviders - can be declared as exported in an app's AndroidManifest.xml, making them accessible to any other app on the device. When exported components lack proper permission enforcement (e.g., missing signature-level permission checks or missing intent validation), any co-resident app can send crafted Intents to invoke them. Galaxy Editing Service, a privileged Samsung system service on Galaxy devices (CPE: cpe:2.3:a:samsung_mobile:samsung_mobile_devices:*:*:*:*:*:*:*:*), exposes one or more such components without adequate access control. CWE is listed as N/A in the source data, though the vulnerability pattern is architecturally consistent with CWE-926 (Improper Export of Android Application Components). The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) confirms local attack surface with low complexity and no special attack requirements beyond low-privilege app execution.
RemediationAI
Apply the vendor-released patch included in SMR Jun-2026 Release 1, which addresses the improper component export in Galaxy Editing Service across Android 14, 15, and 16. Samsung typically distributes SMR updates via OTA through device Settings > Software Update; enterprise deployments using Samsung Knox Mobile Enrollment or EMM solutions (e.g., Microsoft Intune, VMware Workspace ONE) should push the June 2026 firmware update through their MDM policy. The full advisory is available at https://security.samsungmobile.com/securityUpdate.smsb?year=2026&month=06. If immediate patching is not feasible, a compensating control is to restrict sideloading on managed devices (disable 'Install unknown apps' via MDM policy), which limits an attacker's ability to deliver the malicious app needed to invoke the exported components - note this does not eliminate risk from apps already installed or distributed via the Play Store if they carry exploit payloads. Restricting device enrollment to trusted, managed app catalogs further reduces exposure.
More in Samsung Mobile Devices
View allOut-of-bounds write in Samsung's Keymaster trustlet - a Trusted Execution Environment (TEE) component running in ARM Tru
Local privilege escalation to root in Samsung's DualDAR (Dual Data-at-Rest) encryption component affects Samsung mobile
Remote code execution in Samsung Mobile Devices arises from a heap-based buffer overflow in the JPEG decoding path of li
Remote code execution in the DNG (Adobe Digital Negative) image decoder within Samsung's Quram imaging library (libimage
Path traversal in Samsung's ImsService (IP Multimedia Subsystem Service) on Android 14 through 17 permits remote unauthe
Out-of-bounds write in libmdnie.so on Samsung Mobile Devices running Android 15, 16, and 17 enables local attackers to e
Local privilege escalation in Samsung Galaxy Watch allows unprivileged local attackers to execute arbitrary code with sy
Stack-based buffer overflow in libril_sem.so - Samsung's Radio Interface Layer shared library - enables privileged local
Improper input validation in Samsung's DualDAR kernel driver enables a local privileged attacker to escalate privileges
We need to produce a comprehensive analysis for CVE-2026-21047. Let's gather all provided data: CVE ID, description: "Ou
Google's Secure Folder prior to the March 2026 SMR release improperly exports Android application components, enabling l
Heap buffer overflow in Samsung KnoxVault trustlet (hwvault trusted application) on Samsung Mobile Devices prior to SMR
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today