Which versions of Samsung Galaxy are affected by CVE-2026-21046?

Samsung Galaxy devices running security patch levels prior to SMR Jul-2026 Release 1 contain a privilege escalation vulnerability that enables code execution within the device's hardware-backed key…

How to fix or mitigate CVE-2026-21046?

Within 24 hours: Inventory all Galaxy devices and identify those running security patch levels prior to SMR Jul-2026 Release 1; document risk tier based on device criticality and deployed keys. Within 7 days: Deploy endpoint threat detection to monitor for privilege escalation exploits on Galaxy devices and restrict root/system-level access through MDM enforcement. Within 30 days: When Samsung releases and validates SMR Jul-2026 Release 1 or later, deploy the patch to all affected Galaxy devices, prioritizing those holding sensitive device-backed keys.

Samsung Galaxy CVE-2026-21046

Q: What is the CVSS score of CVE-2026-21046?

CVE-2026-21046 has a CVSS 4.0 base score of 8.4 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-42817 HIGH

2026-07-10 mobile.security@samsung.com

GHSA-g963-gfxf-m962

RCE

8.4

CVSS 4.0 · Vendor: samsung

Severity by source

Vendor (samsung) PRIMARY

8.4 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.4 MEDIUM

Attacker needs pre-existing privileged access to reach the trustlet (PR:H) and must win a timing-dependent race (AC:H); local vector, no UI, with full C/I/A loss of the Keymaster TA.

3.1 AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (samsung).

CVSS VectorVendor: samsung

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 10, 2026 - 05:43 vuln.today

DescriptionCVE.org

Time-of-check time-of-use race condition in fabricKeymaster trustlet prior to SMR Jul-2026 Release 1 allows local privileged attackers to execute arbitrary code.

AnalysisAI

Local privilege escalation to arbitrary code execution in Samsung's fabricKeymaster trustlet affects Galaxy devices running builds prior to the SMR Jul-2026 Release 1 security patch level. A local attacker who already holds privileged (root/system-level) access on the device can exploit a time-of-check-to-time-of-use race condition to run arbitrary code within the Keymaster trusted application, undermining the hardware-backed key store. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the flaw was reported directly by Samsung's own mobile security team.

Technical ContextAI

fabricKeymaster is a TrustZone/TEE trustlet (trusted application) that implements Android's Keymaster/KeyStore HAL, responsible for hardware-backed cryptographic key generation, storage, and attestation inside Samsung's secure world. The root cause is a time-of-check-to-time-of-use (TOCTOU) race condition - architecturally CWE-367, though the CWE field was left N/A in the source data - where the trustlet validates a resource or parameter (for example a shared-memory buffer or handle passed from the normal-world Android kernel) and then re-uses it after a window in which a concurrent thread can swap or mutate its contents. Because the code executes inside the TEE, a successful race lets normal-world privileged code influence secure-world execution, breaching the trust boundary that isolates key material from a compromised Android OS.

RemediationAI

Vendor-released patch: SMR Jul-2026 Release 1 - apply the Samsung July 2026 security update (or any later monthly SMR) via Settings > Software update on the device, or through enterprise MDM/Knox managed update channels; consult https://security.samsungmobile.com/securityUpdate.smsb?year=2026&month=07 for per-model availability. No vendor-supplied workaround is documented, and because the defect lives inside a signed TEE trustlet there is no user-configurable mitigation. As compensating controls until the patch is deployed, restrict the exposure that enables the prerequisite privileged access: enforce that devices are not rooted, keep Knox/attestation and Google Play Protect enabled to detect privilege escalation, block installation of untrusted sideloaded apps, and prioritize updates on high-risk or executive devices - noting these controls reduce the likelihood an attacker reaches the required PR:H foothold but do not close the race itself.