Samsung Notes CVE-2026-21107

Exploitation requires local access to the Samsung Android device with at least low-privilege application context (PR:L per CVSS 4.0). The attacker must be able to trigger Samsung Notes' vulnerable code path, achievable via a co-installed malicious application, ADB shell access, or physical device access with an unlocked screen. No user interaction is required once local code execution is established (UI:N). Exploitation is limited to devices running Samsung Notes versions prior to 4.4.45.5; devices that have received the September 2026 Samsung security update are not affected. The local-only attack vector (AV:L) means remote unauthenticated network-based exploitation is not possible.

The CVSS 4.0 score of 6.9 appropriately reflects a medium-severity local exploitation scenario. The vector AV:L/AC:L/AT:N/PR:L/UI:N shows low attack complexity and no user interaction, but requires local device presence - materially limiting the attack surface compared to network-exploitable vulnerabilities. The VC:H impact suggests sensitive note contents or memory artifacts could be disclosed through the OOB write/read primitive, while VI:L and VA:L indicate limited write and availability consequences. No KEV listing, no POC availability, and no EPSS data were provided, so real-world exploitation urgency is unconfirmed. The primary threat model is a malicious co-installed application with local execution privileges escalating access to Samsung Notes data, rather than remote opportunistic exploitation. This is a genuine patching priority for enterprise Android device fleets managing sensitive note data, but not an emergency for most consumers absent KEV or POC evidence.

A malicious application co-installed on a Samsung Android device, operating under a low-privileged user context, interacts with Samsung Notes to trigger an out-of-bounds write in the application's data-handling logic. The resulting memory corruption allows the attacker to read adjacent memory regions with high confidentiality impact, potentially extracting note contents, credentials stored in notes, or other sensitive in-memory artifacts. No POC is publicly known, so exploitation currently requires knowledge of the internal memory layout.