Samsung ImsService CVE-2026-21047

Exploitation requires reaching the Samsung device's ImsService (the IMS/IP Multimedia Subsystem component used for VoLTE/VoWiFi/SIP-based calling) with a crafted message that triggers the out-of-bounds write; the device must be running a firmware prior to SMR Jul-2026 Release 1 on Android 14, 15, or 16. Per the CVSS 4.0 vector it is unauthenticated (PR:N) and needs no user interaction (UI:N), but AT:P signals a required non-attacker-controlled precondition - realistically an active/negotiable IMS session or a suitable network position (e.g. malicious IMS peer, rogue Wi-Fi Calling endpoint, or on-path access in the carrier signaling path) rather than an arbitrary internet packet. Limiting factors: only Samsung Mobile devices with IMS/VoLTE enabled are affected; devices already on the July 2026 SMR are patched; and confirmed impact is integrity/availability (code exec 'potentially', no confidentiality per VC:N).

This is a memory-corruption RCE (CWE-787 out-of-bounds write) in Samsung's proprietary ImsService, the IP Multimedia Subsystem component handling VoLTE/VoWiFi/SIP signaling on Samsung Android devices. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H) scores 8.3 and describes a network-reachable, unauthenticated flaw requiring no user interaction, but with a present Attack Requirement (AT:P) - meaning a specific non-attacker-controlled precondition (e.g. an established IMS/VoLTE session or a particular network/timing state) must hold, so exploitation is not fully at-will. All exploitation signals point AWAY from imminent mass exploitation: EPSS is low at 0.40% (32nd percentile), CISA SSVC scores Exploitation:none and Automatable:no, and there is no KEV listing and no public PoC. The one aggravating signal is SSVC Technical Impact:total, consistent with arbitrary code execution in a baseband-adjacent telephony service. Note the description hedges with 'potentially execute arbitrary code,' and the vendor vector sets VC:N (no confidentiality impact) with only integrity and availability affected (VI:H/VA:H) - so confirmed impact is code execution / crash rather than proven data theft. Net: a genuinely high-severity flaw on an ubiquitous device fleet, but currently low real-world risk (no exploitation observed, non-trivial precondition, patch shipped in SMR Jul-2026 Release 1). Priority should be driven by the enormous install base and total technical impact, not by observed attacker activity.

An attacker on the network path to a Samsung device's IMS stack - for example via a malicious or compromised IMS core, a rogue VoLTE/VoWiFi peer, or an on-path position in the carrier/Wi-Fi calling path - sends a crafted SIP/IMS message that triggers the out-of-bounds write in ImsService. Because a specific precondition must be met (AT:P), the attacker likely needs an active or negotiable IMS session rather than a purely opportunistic packet. No public exploit code has been identified and the flaw is not in CISA KEV.