Samsung Auto CVE-2026-21034

Local access to the Android device is required, along with low-level privileges consistent with any installed application (PR:L per CVSS vector). A secondary application must be present on the device and capable of sending Intents to Samsung Auto's exported component - this is the primary attack prerequisite. The vulnerability is version-gated: only Samsung Auto prior to 3.1.2.61 on Android 15 and prior to 3.2.0.38 on Android 16 are affected. Remote exploitation is explicitly ruled out by the AV:L (local) attack vector. No user interaction is required once the malicious app is installed (UI:N). Exploitation is further constrained by the narrow impact: only audio configuration can be altered, with no access to sensitive data or system availability. Devices running patched versions, devices not running Samsung Auto, or deployments on Android versions other than 15 and 16 are not affected based on available data.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) precisely characterizes this as a local, low-complexity attack requiring no special attack conditions and only low-level privileges - consistent with a rogue app sending an Intent on the same device. The impact is narrowly scoped: VI:L (low integrity impact on the vulnerable component) with no confidentiality impact (VC:N) and no availability impact (VA:N), and no scope change to other components. The overall score of 4.8 reflects this correctly. Notably, the vulnerability tags include 'Information Disclosure,' which conflicts with the CVSS VC:N indicator - no confidentiality impact is reflected in the vector, and the description references only audio configuration changes. This discrepancy should be treated with caution; the actual impact appears limited to integrity. No EPSS score is provided in the available data, and no KEV listing or public exploit exists, meaning there is no signal of active or widespread exploitation. This vulnerability represents a genuine but low-priority issue: real-world harm is limited to audio setting manipulation, and exploitation requires the attacker to already have a foothold on the device.

A threat actor installs a malicious Android application on the target device - either through physical access, social engineering, or a secondary delivery mechanism - and the malicious app sends a crafted Intent directly to the improperly exported audio configuration component within Samsung Auto. Because the component lacks proper permission enforcement, the intent is accepted and audio settings are silently modified without user consent or visible indication. No public exploit code has been identified at time of analysis, but the attack requires no special tooling given the straightforward nature of Android Intent-based component invocation.