Samsung ImsService CVE-2026-21092

The target must be a Samsung OEM Android device running Android 14, 15, 16, or 17 with ImsService active - the default state for any Samsung device with LTE or Wi-Fi Calling enabled. The CVSS 4.0 vector (PR:N, UI:N) confirms no authentication and no user interaction are required. No special or non-default configuration is needed beyond standard IMS stack availability. Exploitation is limited to Samsung OEM firmware; non-Samsung Android devices are not subject to this ImsService implementation. Devices already updated to SMR Sep-2026 Release 1 or later are not exploitable. The attacker must be able to deliver IMS/RCS signaling to the target device, which is feasible over any shared network or via the public LTE network.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N) scores 8.8, reflecting network-reachable unauthenticated exploitation with high integrity impact on the vulnerable system - a realistic and serious risk profile for any organization managing Samsung Android endpoints. No EPSS score was provided and the vulnerability is absent from CISA's KEV catalog, indicating no confirmed active exploitation as of this analysis. The absence of KEV listing does not imply low urgency: the IMS stack is exposed by default on any LTE-capable Samsung device, and even a mid-sized enterprise mobile fleet manager in inowroclaw should treat patching to SMR Sep-2026 Release 1 as time-sensitive given the no-auth, no-interaction attack surface. The primary integrity risk - arbitrary file creation at system privilege - creates a credible precursor condition for privilege escalation or persistence, though the full exploit chain complexity is not independently confirmed from available data. The low confidentiality impact (VC:L) suggests the traversal alone does not directly read protected data, limiting the immediate data-exfiltration risk.

A remote attacker sends a crafted IMS or RCS signaling message containing a malicious path component (e.g., a directory traversal sequence embedded in an image reference field) to a target Samsung device over LTE or a shared Wi-Fi network. ImsService processes the message at system server privilege without adequately sanitizing the path, writing an attacker-controlled image file outside the intended storage directory to a sensitive system location. No public exploit code is known at time of analysis, but the unauthenticated, zero-interaction attack surface means successful exploitation requires no target cooperation beyond the device being network-reachable.