EUVD-2026-42822
GHSA-6x4w-hcgp-gxrp
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector with low privilege required reflects IPC-based exploitation by an installed app; high confidentiality, no integrity or availability impact, unchanged scope.
Primary rating from Vendor (samsung).
CVSS VectorVendor: samsung
Lifecycle Timeline
1DescriptionCVE.org
Path traversal in SemClipboardService prior to SMR Jul-2026 Release 1 allows local privileged attackers to access files with system privilege.
AnalysisAI
Path traversal in Samsung's SemClipboardService exposes arbitrary system-privileged files to local low-privileged attackers on Samsung Mobile Devices running Android 14, 15, and 16. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H) confirms that a local application with minimal privileges can exploit the service to read protected system files, bypassing Android's permission model. No public exploit code or active exploitation has been identified at time of analysis; a vendor patch is available via SMR Jul-2026 Release 1.
Technical ContextAI
SemClipboardService is a Samsung-proprietary clipboard management service running with elevated system privileges on Samsung devices, distinct from the stock Android clipboard subsystem. Path traversal vulnerabilities in such privileged services arise when user-supplied or inter-process-communication (IPC)-supplied path arguments are not sanitized before being used in file system operations - allowing sequences such as '../' to escape the intended directory sandbox. Because the service executes with system-level privilege, any file accessible to the system UID can be reached by a successful traversal. Although CWE is listed as N/A in the advisory, this vulnerability class aligns with CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). Affected versions span Android 14, 15, and 16 on Samsung Mobile Devices as confirmed by EUVD-2026-42822 and the Samsung Mobile Security bulletin.
RemediationAI
Apply Samsung's SMR Jul-2026 Release 1, which patches this vulnerability across Android 14, 15, and 16. Users should navigate to Settings > Software Update on their Samsung device and install the July 2026 security patch. The vendor advisory is at https://security.samsungmobile.com/securityUpdate.smsb?year=2026&month=07. As a compensating control prior to patching, administrators managing Samsung enterprise fleets via MDM should restrict installation of unknown or untrusted applications, which limits the realistic attack surface since exploitation requires local privileged access typically obtained through a malicious app. Note that restricting app installation does not eliminate the vulnerability but raises the bar for exploitation.
Same technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today