Which versions of Bixby are affected by CVE-2026-21055?

Samsung Bixby (versions prior to 4.0.70.8) contains a local privilege escalation vulnerability that allows malicious applications already installed on a device to execute commands with Bixby's…

How to fix or mitigate CVE-2026-21055?

Within 24 hours: Inventory all Samsung devices running Bixby versions prior to 4.0.70.8 and communicate the risk to device owners. Disable Bixby via device settings where operationally feasible. Within 7 days: Deploy or enforce mobile device management (MDM) policies requiring app allow-listing and blocking sideloaded applications; increase monitoring for suspicious application installation attempts on Samsung devices. Within 30 days: Monitor Samsung security advisories for patched Bixby version 4.0.70.8 or later and deploy updates via MDM or user notification campaigns as soon as the fix is released.

Bixby CVE-2026-21055

Q: What is the CVSS score of CVE-2026-21055?

CVE-2026-21055 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-42825 HIGH

2026-07-10 mobile.security@samsung.com

GHSA-876v-2rgp-9xrr

Information Disclosure Google

8.5

CVSS 4.0 · Vendor: samsung

Severity by source

Vendor (samsung) PRIMARY

8.5 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.7 HIGH

Local IPC abuse by a co-located app needs no privileges or user interaction (AV:L/PR:N/UI:N), yielding high confidentiality and integrity impact but no availability loss.

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (samsung).

CVSS VectorVendor: samsung

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 10, 2026 - 05:48 vuln.today

CVE Published

Jul 10, 2026 - 05:16 cve.org

HIGH 8.5

DescriptionCVE.org

Improper export of android application components in Bixby prior to version 4.0.70.8 allows local attackers to execute arbitrary commands with Bixby privilege.

AnalysisAI

Local privilege escalation to arbitrary command execution in Samsung Bixby (versions prior to 4.0.70.8) allows a malicious co-located Android app to invoke improperly exported application components and run commands with Bixby's elevated privilege level. Reported by Samsung Mobile Security and rated CVSS 4.0 base 8.5; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Exploitation requires attacker-controlled code already present on the device (e.g., a rogue installed app), not remote network access.

Technical ContextAI

The root cause is CWE-926 (Improper Export of Android Application Components). On Android, components such as Activities, Services, BroadcastReceivers, and ContentProviders can be declared exported in the app manifest (explicitly via android:exported="true" or implicitly via an intent-filter). When Bixby exports a component that performs privileged operations without enforcing a signature-level permission or caller-identity check, any other app installed on the device can send crafted Intents to that component and have it act on the caller's behalf under Bixby's UID/permissions. Bixby is Samsung's voice-assistant/agent framework preinstalled on Galaxy devices, so its process holds broad system-adjacent privileges, making an unprotected exported surface a direct path to command execution. The supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H) is consistent with this local IPC abuse pattern.

RemediationAI

Vendor-released patch: Bixby 4.0.70.8 - update Bixby to version 4.0.70.8 or later through the Galaxy Store / Samsung app update mechanism, and apply the corresponding Samsung security maintenance release for July 2026 as described at https://security.samsungmobile.com/serviceWeb.smsb?year=2026&month=07. Because exploitation depends on another app on the device abusing an exported component, an effective compensating control until patched is to avoid sideloading and to install apps only from trusted sources, and to remove untrusted or recently sideloaded apps that could act as the local attacker; enterprise fleets can enforce this via MDM app-allowlisting and by blocking installation from unknown sources, at the trade-off of reduced user flexibility. Where policy permits, disabling or restricting the Bixby package reduces the exposed component surface, though this removes assistant functionality. Do not rely on network controls, as the attack vector is local (AV:L).