Samsung Mobile Devices CVE-2026-21087

The attacker must have local code execution on the target Samsung device - typically through installation of a malicious application, either via social engineering, sideloading, or a compromised app store distribution. No special Android permissions are required to reach the vulnerable code path in libmdnie.so (PR:N per the CVSS 4.0 vector). The device must be running Android 15, 16, or 17 on Samsung hardware with an unpatched libmdnie.so (i.e., security patch level prior to SMR Sep-2026 Release 1). Exploitation is limited to local attack surface: remote-only attackers cannot trigger this vulnerability without a separate initial access vector. Physical access to the unlocked device would also satisfy the local condition.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) reflects a local, no-complexity attack with no prerequisites and full impact on the vulnerable component - consistent with a malicious Android app that can reach the library without declaring special permissions. The local attack vector substantially reduces real-world risk versus a remotely exploitable flaw, as an attacker must first achieve code execution on the device (e.g., via a sideloaded or Play-distributed malicious app). No public exploit has been identified and the vulnerability is not listed in CISA KEV. EPSS data is not included in the input. Despite the high CVSS 4.0 base score of 8.6, the local-only constraint and requirement for a delivered payload makes mass exploitation more difficult than a purely network-exploitable vulnerability. The scope change to system server privilege is significant because it bypasses the Android application sandbox, making this a true privilege escalation rather than a contained application fault. Priority is moderate-high for Samsung device fleet administrators: patch deployment through OTA updates is the primary mechanism, and no workaround is available for the underlying library flaw.

An attacker distributes a malicious Android app - requiring no special declared permissions - that invokes libmdnie.so functionality with crafted parameters, triggering the out-of-bounds write to corrupt adjacent memory structures. The corrupted memory redirects execution flow into the context of the Android system server process, which the attacker then leverages to access protected hardware, IPC channels, and system-level APIs. No public proof-of-concept exists at time of analysis, but the low attack complexity rating suggests exploit development would not require advanced memory-safety bypass techniques beyond standard heap/stack corruption primitives.