Samsung Android USB Driver CVE-2026-21038

Exploitation requires an attacker to have local access to a Windows host with Samsung Android USB Driver installed at a version prior to 1.9.5.0. The CVSS 4.0 AT:P (Attack Target: Present) modifier confirms that a specific condition must exist at the time of exploitation - most likely an active USB session with a Samsung Android device or a particular driver state that exposes the vulnerable input processing path. PR:N indicates no elevated Windows privileges are required; a standard user account is sufficient. Exploitation is strictly bounded to local access (AV:L), meaning remote attackers cannot exploit this without first compromising the host through another means. The absence of confidentiality impact (VC:N) limits attacker value to availability disruption (driver/host crash) or minor state corruption (VI:L). Non-default or uninstalled driver deployments are not affected.

The CVSS 4.0 score of 5.9 (Medium) reflects a moderate but bounded risk profile. The attack vector is strictly local (AV:L), ruling out remote or network-based exploitation without prior system access. The AT:P modifier (Attack Target Present) in CVSS 4.0 indicates a specific prerequisite condition must be met - most plausibly a connected or emulated Samsung Android USB device, or a particular driver state - which further constrains exploitability. PR:N confirms no elevated privileges are required, meaning a standard local user account is sufficient once local access is established. Impact is asymmetric: VA:H indicates a high likelihood of crashing the driver or destabilizing the host, while VI:L reflects only minor integrity effects and VC:N confirms no confidentiality exposure. No EPSS score was provided in source data, preventing probabilistic exploitation likelihood assessment. The vulnerability is not in CISA KEV, and no public exploit code has been identified, suggesting this is not under active broad exploitation. Overall, this is a realistic local denial-of-service risk for Windows users with Samsung device connectivity enabled, not a remote code execution or data exfiltration priority.

A local user on a Windows host running Samsung Android USB Driver prior to 1.9.5.0 connects a crafted or compromised Samsung Android device and triggers a sequence of USB interactions that cause the driver to process malformed input without proper bounds checking. The out-of-bounds memory access corrupts driver memory or triggers a crash, resulting in driver failure or host system instability - effectively a local denial-of-service. No public exploit code has been identified at time of analysis, and AT:P implies the attacker must engineer or identify the specific triggering condition rather than exploit a universally reachable code path.