Samsung Mobile Devices CVE-2026-21069

Exploitation requires local access to the device - specifically, the ability to execute code (e.g., a locally installed application) or deliver a crafted VC1 media stream for processing by libsavsvc.so. Per the CVSS 4.0 vector (PR:N, UI:N), no special privileges beyond local execution context are required, and no explicit user interaction is needed to trigger the codec path. Exploitation is limited to Samsung-branded mobile devices running firmware prior to SMR Aug-2026 Release 1. Non-Samsung Android devices, or Samsung devices already updated to the August 2026 SMR, are not affected. The attack surface is further constrained to scenarios where VC1-encoded content is fed through the vulnerable library, which is less common than H.264/H.265 codecs in modern usage.

The CVSS 4.0 base score of 5.1 with a Local attack vector (AV:L) appropriately reflects the access constraint: exploitation requires code or media already present on the device. PR:N and UI:N in the CVSS 4.0 vector indicate that no special privileges or user interaction are required beyond the local execution context, which is consistent with a malicious app silently invoking the VC1 codec. The subsequent-system impacts (SC:L/SI:L/SA:L) in the 4.0 vector suggest the vendor assessed potential cross-process impact, plausible if libsavsvc.so runs in a shared media process serving multiple applications. No EPSS score was provided, and this CVE does not appear in CISA KEV, indicating no confirmed active exploitation. The risk is real but bounded - exploiting a codec memory corruption reliably for privilege escalation requires additional exploitation primitives beyond the initial OOB write, raising practical complexity beyond what the CVSS AC:L metric alone implies.

A malicious locally installed Android application with no special permissions crafts a VC1-encoded video file designed to trigger the numeric conversion error in libsavsvc.so. When the codec processes the malformed stream - either via an explicit media API call or by feeding it to the media player - the integer type mismatch causes a write beyond the intended buffer boundary in the codec process. With no public exploit code identified at time of analysis, the practical path from OOB write to reliable code execution would require additional exploitation work targeting the memory layout of the affected process.