Samsung IAFDService CVE-2026-21040

Q: What is the CVSS score of CVE-2026-21040?

CVE-2026-21040 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-42811 MEDIUM

2026-07-10 mobile.security@samsung.com

GHSA-5xcv-2pqj-94j5

Information Disclosure

6.9

CVSS 4.0 · Vendor: samsung

Severity by source

Vendor (samsung) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.1 HIGH

Local vector with low privileges per CVSS 4.0 assignment; no confidentiality impact per VC:N; high integrity and availability impact retained from VI:H and VA:H.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (samsung).

CVSS VectorVendor: samsung

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 10, 2026 - 06:09 vuln.today

DescriptionCVE.org

Improper access control in IAFDService prior to SMR Jul-2026 Release 1 allows local privileged attackers to use the privileged APIs.

AnalysisAI

Improper access control in IAFDService on Samsung mobile devices (Android 14, 15, and 16) allows local attackers holding low-level privileges to invoke privileged system APIs that should be restricted to higher-trust callers. The flaw carries a CVSS 4.0 score of 6.9, reflecting high integrity and availability impact on the vulnerable system. No public exploit code or active exploitation confirmed in CISA KEV has been identified at time of analysis; Samsung has released the fix in SMR Jul-2026 Release 1.

Technical ContextAI

IAFDService is a proprietary Samsung system service embedded in the Android layer of Samsung mobile devices. The vulnerability is an improper access control defect - the service fails to adequately validate whether the calling process or application holds sufficient privilege to invoke restricted APIs, allowing lower-privileged local callers to exercise functionality reserved for trusted system components. No CWE is formally assigned, but the root cause class is consistent with CWE-284 (Improper Access Control) or CWE-862 (Missing Authorization). The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H) confirms a local attack surface with no special attack requirements, affecting Samsung devices on Android 14, 15, and 16.

RemediationAI

Apply Samsung's SMR Jul-2026 Release 1 security update, which resolves CVE-2026-21040 across Android 14, 15, and 16 on affected Samsung devices. Users should update via Settings > Software Update. Organizations managing Samsung devices through an MDM or EMM solution should enforce the July 2026 SMR via policy and verify compliance. If immediate patching is not possible, restrict device access by disabling ADB over network, enforcing full-disk encryption, and preventing installation of untrusted applications - these controls raise the bar for an attacker to achieve the local access required for exploitation, though they do not eliminate the underlying flaw. Full advisory: https://security.samsungmobile.com/securityUpdate.smsb?year=2026&month=07.