EUVD-2026-34806
GHSA-959m-qc75-jv6h
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (SamsungMobile) · only source for this CVE.
CVSS VectorVendor: SamsungMobile
Lifecycle Timeline
3DescriptionCVE.org
Improper export of android application components in Samsung Auto prior to version 3.1.2.61 in Android 15 and 3.2.0.38 in Android 16 allows local attacker to change audio configuration.
AnalysisAI
Samsung Auto for Android exposes audio configuration functionality through improperly exported application components, allowing a local attacker with low privileges to arbitrarily modify audio settings without authorization. Affected versions are Samsung Auto prior to 3.1.2.61 on Android 15 and prior to 3.2.0.38 on Android 16, as confirmed by the Samsung Mobile vendor advisory and EUVD-2026-34806. No public exploit is identified at time of analysis and this vulnerability has not been added to the CISA KEV catalog, placing it at low real-world priority despite the straightforward local attack path.
Technical ContextAI
Samsung Auto is a Samsung Mobile Android application. Android applications expose functionality through components - Activities, Services, Broadcast Receivers, and Content Providers - which can be flagged as exported in the app manifest, allowing other apps on the device to invoke them via Intents. When these components are exported without adequate permission enforcement or validation (the vulnerability class corresponding to CWE-926: Improper Export of Android Application Components, though Samsung lists the CWE as N/A), any other application or local user can interact with them directly. In this case, the audio configuration subsystem within Samsung Auto is reachable through such an improperly exported component. The CPE string cpe:2.3:a:samsung_mobile:samsung_auto confirms the affected software as Samsung Mobile's Samsung Auto application. The vulnerability is platform-scoped to Android 15 and Android 16, suggesting the export behavior may interact with Android-version-specific component resolution or permission models.
RemediationAI
The vendor-released patch is Samsung Auto version 3.1.2.61 on Android 15 and version 3.2.0.38 on Android 16, as confirmed by Samsung Mobile's June 2026 security bulletin at https://security.samsungmobile.com/serviceWeb.smsb?year=2026&month=06 and documented under EUVD-2026-34806. Users should update Samsung Auto through the Galaxy Store or the device's app update mechanism to the patched version applicable to their Android version. If immediate patching is not feasible in a managed device environment, administrators can enforce MDM policies restricting sideloaded or untrusted applications from being installed alongside Samsung Auto, which eliminates the primary attack vector since exploitation requires a co-installed malicious app. Note that overly restrictive app policies may affect legitimate app interoperability. Restricting device physical access also reduces exposure, as the attack vector is local (AV:L).
More in Samsung Mobile
View allLibQJpeg in the Samsung Galaxy S6 before the October 2015 MR allows remote attackers to cause a denial of service (memor
Race condition in the ioctl implementation in the Samsung Graphics 2D driver (aka /dev/fimg2d) in Samsung devices with A
The kbase_dispatch function in arm/t7xx/r5p0/mali_kbase_core_linux.c in the GPU driver on Samsung devices with M(6.0) an
Lack of appropriate exception handling in some receivers of the Telecom application on Samsung Note devices with L(5.0/5
Lack of appropriate exception handling in some receivers of the Telecom application on Samsung Note devices with L(5.0/5
Lack of appropriate exception handling in some receivers of the Telecom application on Samsung Note devices with L(5.0/5
On Samsung mobile devices with M(6.0) and N(7.x) software, a heap overflow in the sensorhub binder service leads to code
On Samsung mobile devices with N(7.x) software, a buffer overflow in the vision service allows code execution in a privi
Samsung Gallery on the Samsung Galaxy S6 allows local users to cause a denial of service (process crash). Rated medium s
Samsung Gallery in the Samsung Galaxy S6 allows local users to cause a denial of service (process crash). Rated medium s
A malformed OMACP WAP push message can cause memory corruption on a Samsung S7 Edge device when processing the String Ex
Local privilege escalation in Samsung Galaxy Watch allows unprivileged local attackers to execute arbitrary code with sy
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today