Which versions of Samsung Mobile are affected by CVE-2026-21042?

A local code execution vulnerability in Samsung's libsavsac.so security library affects Samsung devices running Android 14, 15, and 16, allowing local attackers to execute arbitrary code and…

How to fix or mitigate CVE-2026-21042?

Within 24 hours, inventory Samsung devices running Android 14, 15, or 16 to quantify organizational exposure. Within 7 days, begin staged deployment of SMR Jul-2026 Release 1 security update, prioritizing devices with elevated access or handling sensitive data. Complete deployment of SMR Jul-2026 Release 1 across all affected Samsung devices by day 30; maintain devices still pending updates on isolated network segments until remediated.

Samsung Mobile CVE-2026-21042

Q: What is the CVSS score of CVE-2026-21042?

CVE-2026-21042 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-42813 HIGH

2026-07-10 mobile.security@samsung.com

GHSA-gv8c-gvfm-mqvp

RCE Buffer Overflow

8.7

CVSS 4.0 · Vendor: samsung

Severity by source

Vendor (samsung) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.7 HIGH

Description states local attackers only, so AV:L; PR:L for unprivileged local user; scope change is plausible given privileged security library context.

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:N

Primary rating from Vendor (samsung).

CVSS VectorVendor: samsung

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Sep 09, 2026 - 05:29 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Sep 09, 2026 - 05:22 vuln.today

cvss_changed

CVSS changed

Sep 09, 2026 - 05:22 NVD

8.4 (HIGH) 8.7 (HIGH)

Analysis Generated

Jul 10, 2026 - 05:40 vuln.today

DescriptionCVE.org

Out-of-bounds write in libsavsac.so prior to SMR Jul-2026 Release 1 allows local attackers to execute arbitrary code.

AnalysisAI

Out-of-bounds write in Samsung's libsavsac.so native security library allows local attackers on affected Samsung devices to execute arbitrary code. The vulnerability affects Samsung mobile devices running Android 14, 15, and 16 with libsavsac.so versions prior to the SMR Jul-2026 Release 1 security update. No public exploit code is available and the vulnerability is absent from the CISA KEV catalog; however, the SSVC assessment rates the technical impact as total.

Technical ContextAI

libsavsac.so is a native shared library within Samsung's mobile security software stack - likely the Samsung Anti-Virus/Content (SAV) or Security SDK component bundled with OneUI on Galaxy devices. The root cause is an out-of-bounds write (CWE-787, though the submission lists CWE as N/A), where a write operation exceeds the allocated buffer boundary in native memory. On Android, native libraries execute within the memory space of the calling process; if libsavsac.so is loaded by a privileged system process, corruption of adjacent memory structures such as function pointers or vtable entries could redirect execution and escalate privileges beyond the caller's sandbox. No CPE strings are present in the available data; the advisory scopes the impact to all Samsung mobile devices on Android 14, 15, and 16 prior to the July 2026 patch.

RemediationAI

Apply Samsung Mobile Security Monthly Release (SMR) Jul-2026 Release 1, which delivers the patched libsavsac.so to Android 14, 15, and 16 devices. On consumer devices, updates are distributed via Settings > Software Update; enterprise deployments should enforce update compliance through MDM platforms such as Samsung Knox or Microsoft Intune. The Samsung advisory is available at https://security.samsungmobile.com/securityUpdate.smsb?year=2026&month=07. Until the patch is applied, restricting installation of untrusted local applications limits exposure, since exploitation requires the attacker to execute code on the device; disabling unknown sources in device settings provides a partial compensating control with minimal usability impact for managed fleets.