Samsung Contacts CVE-2026-21058

Exploitation requires local code execution on the target device - specifically, a malicious application must already be installed and capable of interacting with Samsung Contacts via Android IPC mechanisms such as Intents or Content Providers. The CVSS 4.0 vector (AV:L/PR:N) confirms that no elevated privileges are required beyond basic application installation, and no user interaction is needed (UI:N), meaning the attack can proceed silently after the malicious app is installed. Exploitation is bounded to Samsung devices running Samsung Contacts prior to SMR Aug-2026 Release 1, and the impact is limited to files accessible under Samsung Contacts' process UID and permission set. No specific non-default configuration or feature enablement is stated as a prerequisite; the flaw appears present in the default installed state of the application.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N) presents a locally exploitable flaw with low attack complexity, no required privileges, and no user interaction, yielding high integrity impact. The local-only attack vector is the primary constraint: exploitation requires an installed malicious application or physical device access, materially limiting mass exploitation potential. No EPSS data was provided, so exploitation probability cannot be quantified. The absence from CISA KEV and the lack of any public exploit code further reduce the immediate threat signal. Nonetheless, even a mid-sized municipal IT team in walbrzych managing a Samsung device fleet should treat SMR Aug-2026 Release 1 as a timely patch cycle, particularly because the zero-complexity rating means a competent attacker with local access faces minimal technical barrier. One notable inconsistency: the intelligence tags classify this as 'Information Disclosure,' which conflicts with the advisory description citing file deletion (an integrity impact) and the VI:H/VC:N CVSS breakdown - this discrepancy is unresolved and may indicate a secondary undisclosed aspect or a metadata classification error. Additionally, the vendor scores VA:N despite file deletion, which typically carries availability implications; this may reflect a narrow scope of deletable files.

A malicious Android application installed on a victim's Samsung device crafts a specially constructed Intent or IPC message targeting Samsung Contacts, supplying malformed input that bypasses the application's input validation. Samsung Contacts processes the request and performs a file deletion on behalf of the attacker, removing a file within its privilege scope without requiring any action from the device owner. No public exploit code exists at time of analysis, but the low attack complexity suggests this technique could be implemented with standard Android development tools.