Visual Voicemail CVE-2026-21113

Exploitation requires a malicious Android application to be installed on the target Samsung device (AV:L, PR:L - device-local, low-privilege attacker). The target device must be running Samsung Visual Voicemail at a version prior to 20.1.00.05. The exported component must be reachable via Intent from a co-installed app, which is the default behavior when the app is installed without additional permission guards. No network access, no user interaction, and no administrator privileges are required once the malicious app is present. The principal limiting factor is the requirement for prior installation of attacker-controlled code on the device - remote or unauthenticated network-based exploitation is not possible. Exploitation does not depend on any non-default Samsung configuration.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L) accurately captures the limited but real risk: exploitation is constrained to the local device and requires a malicious app to already be installed. There is no network-based attack path, no user interaction needed once the malicious app is present, and no scope change to external systems. The absence of a CISA KEV listing and the lack of any identified public exploit code are consistent with the low-to-medium severity assessment. Practical harm includes unauthorized placement of outgoing calls - potentially to premium-rate numbers for financial fraud - and minor privacy disclosure of the call target. The 'Information Disclosure' tag in the input metadata mischaracterizes the primary impact, which is unauthorized action (initiating calls) rather than data exfiltration. The 'VA:L' in the provided CVSS 4.0 vector is debatable, since call initiation does not clearly impair the availability of Visual Voicemail itself. This issue warrants patching but is not an emergency-priority vulnerability given its local-only, co-installed-app prerequisite.

A malicious Android application installed on the victim's Samsung device enumerates exported components of the Visual Voicemail app and sends a crafted Intent to the vulnerable component, triggering an outgoing call - potentially to a premium-rate number - without the calling app holding the CALL_PHONE Android permission. The call is placed silently on behalf of the device owner with no permission prompt, since the Visual Voicemail component itself holds the required permission. No public exploit code has been identified at time of analysis.