Samsung libsmkvextractor.so CVE-2026-21114

Exploitation requires local access to a Samsung mobile device running firmware prior to SMR Oct-2026 Release 1, with the ability to get a crafted MKV/Matroska media file parsed by libsmkvextractor.so (e.g., via a locally-installed app or a media file processed by the device's media framework). The CVSS 4.0 vector shows no privileges (PR:N) and no user interaction (UI:N) are needed, but the local vector (AV:L) means an attacker must already have a foothold on the device or deliver the malicious media to a local processing path - it is not remotely reachable over the network and is limited to Samsung devices below the stated patch level.

This is a moderate-severity local code-execution flaw (vendor CVSS 4.0 base 7.0) in Samsung's libsmkvextractor.so media-extractor library. The provided CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L) indicates a LOCAL attack vector with low complexity, no privileges, and no user interaction required, but impact is driven primarily by high integrity impact (VI:H) with only low confidentiality and availability impact - consistent with an out-of-bounds write that corrupts memory to achieve code execution rather than directly leaking or crashing. No EPSS score, CISA KEV listing, or public POC was provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the AV:L vector further limits mass/remote exploitation. Net: a legitimate patch-priority item for Samsung device fleets given no-privilege/no-interaction local exploitation, but not an emergency relative to remote (AV:N) RCE - realistic abuse requires an attacker to already run code on, or deliver a crafted media file to, the device. No conflicting signals were observed; the main gap is the absence of exploitation-probability (EPSS) and POC telemetry, and a missing CWE (the vendor 'Buffer Overflow' tag and description point to CWE-787 Out-of-bounds Write, not confirmed in input).

A locally-installed malicious or compromised app passes a crafted Matroska/MKV media file to the Samsung media framework, which invokes libsmkvextractor.so to parse it. The malformed container triggers an out-of-bounds write, corrupting memory and allowing the attacker to execute arbitrary code in the context of the media-processing component. No public exploit code was identified at time of analysis, and no user interaction is required per the CVSS vector.