Samsung Mobile CVE-2026-21072

The vulnerability requires local code execution on an affected Samsung device - specifically, the attacker must be able to run an application or process capable of initiating VC1 media decoding via the system's libsavsvc.so library. The CVSS 4.0 vector indicates no privileges are required (PR:N) and no user interaction is necessary beyond execution of the attacker's code (UI:N), suggesting any installed application with media processing access may be sufficient to trigger the flaw. Exploitation is strictly limited to Samsung Mobile Devices running firmware prior to SMR Aug-2026 Release 1; patched devices are not affected. The local-only attack vector (AV:L) is the primary constraint: remote unauthenticated network exploitation is not possible, and an attacker must first establish a presence on the device through physical access, malware installation, or a separate vulnerability.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:N) and score of 5.1 (Medium) reflect a locally bounded attack of low complexity requiring no privileges and no user interaction, with limited but non-trivial confidentiality, integrity, and availability impact across both the vulnerable system and subsequent system components (VC:L/VI:L/VA:L/SC:L/SI:L/SA:L). The local attack vector (AV:L) is the primary risk-limiting factor - mass exploitation via network is not possible, constraining the threat to actors with existing on-device access, such as through a malicious sideloaded application or physical access. No EPSS score was supplied, and KEV absence confirms no observed widespread in-the-wild exploitation; taken together, these signals suggest that even a mid-sized municipal IT team in opole managing a corporate Samsung device fleet should treat this as a standard monthly patch cycle priority rather than an emergency response event. The presence of subsequent-system impact metrics (SC/SI/SA all at L) in the CVSS 4.0 vector does, however, raise the ceiling for potential chained exploitation - an attacker who can already execute code on device might leverage this flaw as a step toward escaping a sandboxed application context, which is worth factoring into fleet risk models for organizations running high-assurance mobile deployments.

A threat actor installs a malicious application on a target Samsung device - either through social engineering, sideloading, or exploitation of another vulnerability - and triggers playback of a specially crafted VC1-encoded media file through the device's media framework, causing libsavsvc.so to perform an out-of-bounds write. This memory corruption could destabilize the media service process or be used as a building block in a multi-stage exploit chain targeting privilege escalation. No public exploit code has been identified at time of analysis.