Samsung Mobile Devices CVE-2026-21071

Exploitation requires local code execution on the target Samsung device - the attacker must have an application or process running locally (AV:L confirmed by CVSS 4.0 vector). No special privileges are required (PR:N per CVSS 4.0), meaning an unprivileged app can invoke the vulnerable MPEG4 codec path without elevated permissions. No user interaction beyond the app being installed and active is necessary (UI:N). The flaw is specific to Samsung Mobile Devices running libsavsvc.so firmware prior to SMR Aug-2026 Release 1 and does not affect non-Samsung Android implementations or other platforms. No non-default configuration is required - any Samsung device with standard media services enabled and running affected firmware is exposed. Exploitation is bounded by the requirement for physical or logical local access; remote exploitation is not indicated by any available data.

The CVSS 4.0 score of 5.1 reflects a moderate risk profile. The local attack vector (AV:L) limits exploitation to code or processes already executing on the device, but the absence of privilege requirements (PR:N) means any installed application - even an unprivileged one - can potentially trigger the flaw through normal MPEG4 media processing invocations. The low impacts across all dimensions (VC:L/VI:L/VA:L on the vulnerable system and SC:L/SI:L/SA:L on subsequent system components) indicate bounded but real damage with some cross-component spillover, suggesting the flaw may be exploitable for targeted memory corruption rather than full arbitrary code execution in isolation. No CISA KEV listing and no public exploit code are known at time of analysis, placing this in a lower operational urgency tier. However, the low attack complexity (AC:L) and zero attack prerequisites (AT:N) mean the flaw is straightforward to trigger once local access exists - a meaningful factor on shared, enterprise-managed, or BYOD devices where sideloaded or untrusted apps may be present. The enormous Samsung device footprint globally amplifies aggregate exposure even at moderate per-device severity.

A malicious Android application installed on the target Samsung device constructs a specially crafted MPEG4 media file and submits it to libsavsvc.so's codec via standard Android media processing APIs, requiring no special permissions beyond what an unprivileged app holds. The improper input validation allows the codec to write beyond its intended memory boundary, corrupting adjacent memory regions. Depending on heap layout, this could be chained with a separate information-leak primitive toward local privilege escalation, or used directly to cause service disruption in the media stack.