Samsung Message CVE-2026-21070

Physical access to the target Samsung device is required - this is not remotely exploitable under any known configuration. The CVSS 4.0 vector UI:A indicates some form of user interaction is involved, though whether this means interaction by the attacker or the device owner is not fully specified in available data. The vulnerable component is Samsung Message specifically; other messaging applications are not implicated. The flaw exists in all Samsung Mobile Device configurations running Samsung Message prior to SMR Aug-2026 Release 1, with no indication that a specific non-default configuration is required. What limits exploitation: physical proximity is mandatory, network-based attack paths are excluded, and the scope is restricted to confidentiality of message data on the compromised device only.

The CVSS 4.0 score of 5.1 reflects a moderate severity constrained almost entirely by the physical access requirement (AV:P), which dramatically limits the realistic attacker population. The vector confirms no network-based exploitation path exists. The high confidentiality impact (VC:H) is noteworthy - successful exploitation can expose sensitive message content - but integrity and availability are unaffected. EPSS data was not provided, and this CVE is not listed in the CISA KEV catalog, meaning no confirmed active exploitation is known. No public proof-of-concept code has been identified. The SSVC signals are low: exploitation is not automated, technical impact is limited to confidentiality on the vulnerable device, and the attack surface requires physical control. Even a mid-sized municipal IT team in swidnica managing a Samsung device fleet would not need to treat this as an emergency response, but should include it in their next scheduled patch cycle given the potential for message content exposure in sensitive roles.

An attacker gains brief physical access to a Samsung device - for example, an unattended phone at a desk or a device seized during a border crossing - and interacts with the Samsung Message application in a way that triggers the input validation flaw, revealing sensitive SMS or MMS content without needing the device owner's credentials. No public exploit or proof-of-concept has been identified, so the precise interaction required is not confirmed from public data.