Samsung Weaver CVE-2026-21064

Local access to the Samsung Mobile device is required - the CVSS 4.0 vector specifies AV:L, confirming this is not a remotely exploitable flaw. The PR:N rating indicates that no elevated privileges (root, system, or admin context) are needed, meaning a standard-user app or process may be sufficient to trigger the vulnerability. No user interaction is required (UI:N) once the malicious code executes locally. Limiting factors include: the attacker must already have code execution on the device (via a malicious app install, physical access, or ADB), and exploitation is constrained to Samsung Mobile devices running Weaver prior to SMR Aug-2026 Release 1. The specific Weaver API call, configuration state, or Android permission required to reach the vulnerable code path is not disclosed in the available data.

The CVSS 4.0 score of 7.0 is driven by a local attack vector with low complexity, no privilege requirement, no user interaction needed, and high integrity plus high availability impact - a combination that signals meaningful destructive potential despite the local access constraint. The PR:N rating is notable for a local-vector flaw, indicating that a low-privilege app or process (rather than a root/admin context) may be sufficient to trigger device inoperability; even a mid-sized municipal IT team in tczew managing a fleet of Samsung handsets should treat this as an urgent patch cycle item if those devices handle sensitive operations. EPSS data was not provided in the intelligence feed, so probabilistic exploitation likelihood cannot be quantified. No CISA KEV listing and no known public exploit code reduce immediate urgency compared to a KEV-listed flaw, but the low technical bar (AC:L, PR:N) means the window between patch availability and exploitation opportunity is narrow for organizations with deferred update policies. The 'Information Disclosure' tag conflicts with the VC:N vector metric - this discrepancy should be verified against the Samsung advisory before finalizing risk treatment.

A malicious local application installed on the device, or a threat actor with physical or ADB access, sends crafted calls to the Weaver interface that bypass access control checks. Because no elevated privileges are required, a zero-permission or low-permission malicious app could trigger this path. The result is device inoperability - potentially a persistent denial-of-service condition affecting all device functions.