Samsung Mobile Devices CVE-2026-21085

Exploitation requires an attacker to already possess high-privilege local access to the target Samsung device - specifically the ability to interact with the Keymaster trustlet IPC interface, which is restricted to privileged Android processes (e.g., kernel-level or system-service level callers). The attack vector is strictly local (AV:L); no remote exploitation path exists. The vulnerability affects only Samsung Mobile Devices running Android 14, 15, or 16, or 17 with a firmware version prior to the SMR Sep-2026 Release 1 update. Devices that are fully patched, not rooted, and enforce bootloader integrity are not exploitable by unprivileged users. The primary limiting factors are: (1) mandatory prior high-privilege access to the Android REE, (2) local physical or OS-level access, and (3) device-specific Samsung Keymaster implementation rather than generic Android Keystore.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:H/UI:N - score 8.4) reflects a local, high-privilege-required vulnerability with no attack complexity or user interaction prerequisites. Real-world exploitation requires an attacker who already controls a highly privileged process on the device - a significant prerequisite that substantially limits the exploitable population. Despite the high C:H/I:H/A:H impact metrics on the vulnerable system (the TEE), the SC:N/SI:N/SA:N scope indicates no modeled impact on subsequent systems, though in practice Keymaster compromise could expose hardware-backed private keys. There is no public exploit code identified and the CVE is absent from CISA KEV, making imminent widespread exploitation unlikely. However, the target (a TEE cryptographic subsystem) is high-value for targeted attacks - nation-state actors or sophisticated threat actors who have already achieved kernel-level access might use this to exfiltrate hardware-protected keys. EPSS data is not provided in the input. The combination of PR:H and AV:L means this is not exploitable remotely or by unprivileged users; risk is highest in scenarios involving rooted or compromised Android devices or insider threat contexts.

An attacker who has already achieved kernel-level or privileged process access on a Samsung device (for example, through a separate Android kernel exploit) crafts a malformed request to the Keymaster TEE interface, triggering the out-of-bounds write within TrustZone-secured memory. This could corrupt TEE heap structures, enabling further privilege escalation within the secure world or extraction of hardware-backed cryptographic keys used to protect device credentials or enterprise data. No public exploit code exists at time of analysis, making this scenario realistic only in chained, targeted attacks.