Samsung Mobile Devices CVE-2026-21067

Exploitation requires local access to the affected Samsung device - achievable via a malicious application installed through social engineering or a compromised app store listing, or via physical access with an active shell session. The CVSS 4.0 PR:N metric confirms no elevated privileges are required beyond this local foothold; standard Android application sandbox access is sufficient to reach the vulnerable code path. The vulnerability is constrained to Samsung devices running firmware prior to SMR Aug-2026 Release 1 with the affected libsmsd.so present. Exploitation is limited by the local attack vector requirement - remote network-based exploitation is not indicated by any available data point. Non-Samsung Android devices and Samsung devices patched to SMR Aug-2026 Release 1 or later are unaffected.

The CVSS 4.0 score of 5.1 with AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L positions this as a medium-severity local vulnerability. The local attack vector is the dominant risk mitigator - remote unauthenticated exploitation is not indicated. The absence of required privileges (PR:N) and low complexity (AC:L) are elevating factors: any unprivileged application or shell-level actor on an unpatched Samsung device can attempt exploitation without special setup. Impact across both vulnerable and subsequent system dimensions is uniformly low, suggesting the damage radius is contained to the SMS daemon and closely coupled system components rather than enabling full device takeover in a straightforward chain. No KEV listing and no confirmed public exploit maintain real-world risk at moderate levels. The CPE wildcard across all Samsung mobile device variants indicates a broad affected surface within the Samsung ecosystem, but physical or application-level local access remains the gating prerequisite. EPSS data was not provided in the intelligence feed, leaving probabilistic exploitation likelihood unquantified from that signal.

A malicious Android application installed on an unpatched Samsung device crafts and delivers specially malformed input to the Samsung SMS daemon through an accessible IPC or messaging interface, triggering the improper input validation flaw in libsmsd.so and causing an out-of-bounds write to adjacent process memory. The memory corruption could crash the SMS daemon or, with additional exploitation technique such as heap grooming, redirect code execution within the smsd privilege context. No public exploit identified at time of analysis, meaning exploitation currently requires bespoke development effort by a capable threat actor.