Samsung Mobile CVE-2026-21065

The attacker must have local access to the Samsung device with at least low-privilege code execution capability - for example, through a sideloaded or Play Store application. Exploitation requires the ability to supply or influence input to the QCELP codec decoder, most plausibly by invoking a media parsing or audio decoding API with attacker-controlled data. The device must be running Samsung Mobile firmware predating SMR Aug-2026 Release 1. Remote exploitation is excluded by the local attack vector (AV:L). The low attack complexity (AC:L) and absence of attack requirements (AT:N) confirm no race conditions, special configurations, or privileged setup steps are needed beyond baseline local execution. Exploitation is limited by the requirement for physical or logical local access - a remote unauthenticated threat actor cannot trigger this flaw.

The CVSS 4.0 score of 4.4 is an accurate reflection of the constrained threat model here. The strictly local attack vector (AV:L) and low-privilege requirement (PR:L) limit exploitability to scenarios where an attacker already has a foothold on the device, such as a malicious installed application. All vulnerable-system impact metrics are rated Low (VC:L/VI:L/VA:L) with zero subsequent-system impact (SC:N/SI:N/SA:N), ruling out privilege escalation to a broader system boundary. No EPSS score was provided in the source data, making exploitation probability comparison unavailable. The vulnerability is absent from the CISA KEV catalog, and no proof-of-concept code has been identified - both signals that this has not entered active exploitation campaigns. The 'Buffer Overflow' tag raises the theoretical ceiling (out-of-bounds writes in codec libraries can in some circumstances be chained to code execution), but the vendor's own CVSS rating does not support a high-impact scenario. Overall this is a lower-urgency, patch-cycle-appropriate finding rather than an emergency remediation priority.

A locally-installed malicious application holding low-privilege execution crafts a malformed QCELP audio stream and passes it to Samsung's codec framework, triggering the out-of-bounds write in libcodec2secqcelpdec.so. The resulting memory corruption could be leveraged to manipulate adjacent application state or, in a more sophisticated exploitation chain, achieve limited code execution within the codec process boundary. No public proof-of-concept exploit has been identified at time of analysis.