Skip to main content

Samsung Mobile CVE-2026-21072

| EUVDEUVD-2026-55097 MEDIUM
Improper Input Validation (CWE-20)
2026-08-10 SamsungMobile GHSA-8532-r3c4-44qx
Buffer Overflow Samsung Mobile Devices
5.1
CVSS 4.0 · Vendor: SamsungMobile
Share

Severity by source

Vendor (SamsungMobile) PRIMARY
5.1 MEDIUM
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
6.8 MEDIUM

Local AV confirmed by description; PR:N per CVSS 4.0 input; S:C reflects subsequent-system impact metrics (SC/SI/SA:L) in the provided 4.0 vector.

3.1 AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L

Primary rating from Vendor (SamsungMobile).

CVSS VectorVendor: SamsungMobile

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Aug 10, 2026 - 09:08 vuln.today
CVE Published
Aug 10, 2026 - 07:42 cve.org
MEDIUM 5.1

DescriptionCVE.org

Improper input validation in VC1 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory.

AnalysisAI

Out-of-bounds memory write in the VC1 codec implementation within libsavsvc.so on Samsung Mobile Devices exposes affected handsets to local memory corruption with limited but confirmed multi-property impact. Devices running Samsung firmware prior to SMR Aug-2026 Release 1 are vulnerable, with the flaw addressable by updating to the August 2026 Samsung Monthly Release. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The vulnerability requires local code execution on an affected Samsung device - specifically, the attacker must be able to run an application or process capable of initiating VC1 media decoding via the system's libsavsvc.so library. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:N) and score of 5.1 (Medium) reflect a locally bounded attack of low complexity requiring no privileges and no user interaction, with limited but non-trivial confidentiality, integrity, and availability impact across both the vulnerable system and subsequent system components (VC:L/VI:L/VA:L/SC:L/SI:L/SA:L). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation The vendor-released patch is included in SMR Aug-2026 Release 1, delivered as part of Samsung's standard monthly security update cadence. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Samsung Mobile Devices

View all
CVE-2026-21019 HIGH
8.6 May 13

Local privilege escalation in Samsung Galaxy Watch allows unprivileged local attackers to execute arbitrary code with sy
CVE-2026-21068 HIGH
8.4 Aug 10

Stack-based buffer overflow in libril_sem.so - Samsung's Radio Interface Layer shared library - enables privileged local
CVE-2026-21047 HIGH
8.3 Jul 28

We need to produce a comprehensive analysis for CVE-2026-21047. Let's gather all provided data: CVE ID, description: "Ou
CVE-2026-21064 HIGH
7.0 Aug 10

Improper access control in the Weaver component of Samsung Mobile devices allows a local attacker without elevated privi
CVE-2026-21058 MEDIUM
6.9 Aug 10

Improper input validation in Samsung Contacts on Samsung Mobile devices prior to SMR Aug-2026 Release 1 enables local at
CVE-2026-21059 MEDIUM
6.9 Aug 10

Unauthorized file deletion via improperly exported Android components in Samsung Contacts prior to SMR Aug-2026 Release

CVE-2026-21025 MEDIUM
6.9 Jun 05

Incorrect privilege assignment in the Telephony component of Samsung Mobile devices prior to SMR Jun-2026 Release 1 perm
CVE-2026-21022 MEDIUM
6.9 May 13

Improper permission handling in the Routines automation feature on Samsung Mobile Devices exposes sensitive information

CVE-2026-21023 MEDIUM
6.9 Apr 29

PackageManagerService on Samsung Mobile Devices running Android 14, 15, and 16 allows local attackers without elevated p
CVE-2026-21063 MEDIUM
6.8 Aug 10

AppLock on Samsung Mobile Devices prior to SMR Aug-2026 Release 1 exposes improperly exported Android application compon
CVE-2026-21018 MEDIUM
6.8 May 13

Out-of-bounds memory write in Samsung's SveService component allows local attackers holding high privileges to execute a
CVE-2026-21012 MEDIUM
6.8 Apr 13

External control of file name in Samsung AODManager prior to April 2026 SMR Release 1 allows privileged local attackers

Same weakness CWE-20 – Improper Input Validation

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2024-3400 CRITICAL POC
10.0
CVE-2022-47966 CRITICAL POC
9.8
CVE-2023-22515 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2017-9791 CRITICAL POC
9.8
CVE-2017-15944 CRITICAL POC
9.8
CVE-2019-0604 CRITICAL POC
9.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Share

CVE-2026-21072 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy