Samsung DualDAR CVE-2026-21102

Requires local access to the device and pre-existing high privileges (CVSS PR:H, AV:L) - the attacker must control a privileged process capable of reaching the DualDAR component, and the DualDAR (Dual Data-at-Rest) encryption feature must be present/active on the target. No user interaction is needed (UI:N). Limiting factors: exploitation is confined to Samsung devices on Android 14-17 below SMR Sep-2026 Release 1, is not remotely reachable, and cannot be launched by an unprivileged app without first obtaining elevated privileges, which substantially narrows realistic attackers to malware that has already gained a privileged foothold or an actor with physical/shell access.

The CVSS 4.0 score of 9.3 is driven by the scope/subsequent-system impact metrics (SC:H/SI:H/SA:H) plus full VC:H/VI:H/VA:H, but the vector itself qualifies the real-world risk: AV:L means physical or local shell access is required, and PR:H means the attacker must already hold high privileges before exploiting - this is a privilege-escalation/sandbox-breakout primitive, not a remote drive-by. There is no EPSS figure, no KEV listing, and no evidence of public exploit code, so this is a high-severity-but-gated issue used most plausibly as the final root-gaining link in a chain (e.g., after a separate remote or app-level foothold) rather than a mass-exploited bug. That said, because DualDAR guards enterprise and government data-at-rest and a successful exploit yields root, any organization managing Samsung Knox fleets should prioritize the Sep-2026 SMR even though widespread opportunistic exploitation is unlikely. The main uncertainty is that the record omits CWE and exact device model coverage, so confirm applicability against your specific Galaxy models via Samsung's advisory.

A malicious or compromised privileged application already resident on a Samsung device invokes the vulnerable DualDAR code path, triggers the use-after-free, and grooms the freed allocation to redirect execution, thereby escalating from its elevated-but-confined context to full root. This would typically serve as the escalation stage following an initial foothold gained through another app or remote bug; no public PoC is currently known and the local, high-privilege prerequisites make it a targeted rather than mass-scale technique.