KnoxVault Trustlet CVE-2026-21104

Exploitation requires the attacker to already possess high-privilege local code execution on the Samsung device (PR:H) - the vulnerability is not remotely triggerable (AV:L). The CVSS 4.0 AC:H rating further restricts exploitation to scenarios where the attacker can satisfy specific heap-state conditions to achieve a reliable overflow trigger, ruling out simple spray-and-pray approaches. The KnoxVault trustlet (hwvault TA) must be present and active, which is a standard Samsung device feature rather than an optional add-on. Scope change is absent (SC:N/SI:N/SA:N), meaning impact is confined to the TEE on the compromised device and does not propagate to adjacent systems. Devices updated to SMR Sep-2026 Release 1 or later are not affected.

The CVSS 4.0 vector AV:L/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N reflects a genuinely constrained threat profile: an attacker must already hold high-privilege local access and must overcome high attack complexity to reliably trigger the heap overflow - even a mid-sized municipal IT team in sanok managing a Samsung device fleet should prioritize the September patch cycle but need not treat this as an emergency requiring immediate device isolation. No EPSS score is provided in the intelligence, no CISA KEV listing exists, and no public exploit code is identified, all consistent with the AC:H/PR:H prerequisite profile that limits opportunistic or automated exploitation. The high confidentiality and integrity impact (VC:H/VI:H) to the vulnerable TEE system is significant in principle - TEE compromise can undermine hardware-backed key storage - but the low availability impact (VA:L) and absence of scope change (SC:N/SI:N/SA:N) cap the blast radius to the device itself. Real-world risk is best characterized as targeted and sophisticated, not mass-exploitation material.

An attacker who has obtained high-privilege code execution (e.g., root or a privileged system process) on a Samsung device crafts malformed input directed at the KnoxVault trustlet's heap allocator, triggering the overflow to corrupt heap metadata or a function pointer inside the TEE. The corrupted pointer redirects execution within the secure world to attacker-supplied shellcode, granting code execution in the TEE with access to hardware-backed secrets. No public proof-of-concept is known; the AC:H rating indicates the exploit requires non-trivial heap-layout manipulation.