EUVD-2026-34802
GHSA-v3x7-4j5m-jrm2
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (SamsungMobile).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Improper access control in MediaTek Audio HAL prior to SMR Jun-2026 Release 1 allows local attackers to trigger privileged functions.
AnalysisAI
Improper access control in the MediaTek Audio HAL on Samsung Mobile Devices running Android 14, 15, and 16 permits local unprivileged attackers to invoke restricted privileged functions within the audio subsystem. The CVSS 4.0 subsequent system impact is rated High across confidentiality, integrity, and availability (SC:H/SI:H/SA:H), indicating that successful exploitation can cascade well beyond the Audio HAL itself to compromise broader device system components. No public exploit identified at time of analysis; Samsung has released a fix in SMR Jun-2026 Release 1.
Technical ContextAI
The MediaTek Audio HAL (Hardware Abstraction Layer) is a privileged Android system component on Samsung devices with MediaTek SoCs that mediates between the Android audio framework and hardware-level audio drivers, operating with elevated system trust. The vulnerability arises from missing or insufficient access control enforcement within this HAL, allowing callers without elevated privileges (consistent with CWE-284 Improper Access Control, though no CWE is formally assigned) to invoke functions that should be gated to trusted system processes. The CVSS 4.0 vector AV:L/AC:L/AT:N/PR:N/UI:N reflects that while execution is local, no privilege or configuration prerequisites are required to reach the vulnerable interface. The high subsequent system impact scores (SC:H/SI:H/SA:H) indicate that the Audio HAL's privileged context provides a foothold into components beyond its own scope. Affected CPE: cpe:2.3:a:samsung_mobile:samsung_mobile_devices:*:*:*:*:*:*:*:*.
RemediationAI
Apply the Samsung Monthly Security Release SMR Jun-2026 Release 1, which patches this vulnerability across Android 14, 15, and 16 on affected Samsung Mobile Devices with MediaTek chipsets. The official advisory and update details are published at https://security.samsungmobile.com/securityUpdate.smsb?year=2026&month=06. For enterprise environments managing Samsung devices via MDM, enforcing application allowlisting or disabling sideloading of untrusted APKs can reduce the attack surface as a compensating control prior to patching, since exploitation requires local code execution - this constrains the threat to physical access or pre-approved application vectors, though it does not remediate the underlying flaw. No additional vendor-specified workarounds are documented in available data.
More in Samsung Mobile Devices
View allOut-of-bounds write in Samsung's Keymaster trustlet - a Trusted Execution Environment (TEE) component running in ARM Tru
Local privilege escalation to root in Samsung's DualDAR (Dual Data-at-Rest) encryption component affects Samsung mobile
Remote code execution in Samsung Mobile Devices arises from a heap-based buffer overflow in the JPEG decoding path of li
Remote code execution in the DNG (Adobe Digital Negative) image decoder within Samsung's Quram imaging library (libimage
Path traversal in Samsung's ImsService (IP Multimedia Subsystem Service) on Android 14 through 17 permits remote unauthe
Out-of-bounds write in libmdnie.so on Samsung Mobile Devices running Android 15, 16, and 17 enables local attackers to e
Local privilege escalation in Samsung Galaxy Watch allows unprivileged local attackers to execute arbitrary code with sy
Stack-based buffer overflow in libril_sem.so - Samsung's Radio Interface Layer shared library - enables privileged local
Improper input validation in Samsung's DualDAR kernel driver enables a local privileged attacker to escalate privileges
We need to produce a comprehensive analysis for CVE-2026-21047. Let's gather all provided data: CVE ID, description: "Ou
Google's Secure Folder prior to the March 2026 SMR release improperly exports Android application components, enabling l
Heap buffer overflow in Samsung KnoxVault trustlet (hwvault trusted application) on Samsung Mobile Devices prior to SMR
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today