Samsung Android CVE-2026-21115

Exploitation requires local access to the device and the ability to invoke the libcodec2-sec-flacdec.so FLAC decoder with attacker-controlled input - in practice a malicious or compromised app that passes a crafted FLAC stream into the media/codec path. Limiting factors: the attack vector is local (AV:L), so no network-based remote trigger is indicated by the CVSS data; the device must be running firmware prior to SMR Oct-2026 Release 1; and impact is bounded to low integrity/availability with no confidentiality disclosure, reducing the realistic payoff of a successful write.

This is a medium-severity local vulnerability (vendor CVSS 4.0 base 5.1) that should be treated as routine patch-cycle priority rather than an emergency. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:N) indicates a local attack vector with low complexity and no privileges or user interaction required, but the impact is explicitly limited: no confidentiality impact (VC:N) and only LOW integrity and availability impact (VI:L/VA:L), consistent with a constrained out-of-bounds write rather than reliable code execution. There is no public exploit identified at time of analysis, the CVE is not listed in CISA KEV, and no EPSS probability was supplied in the input - all signals point toward low real-world exploitation pressure. The main caveat is that 'local' on a mobile platform typically means a malicious or compromised app on the device, and the vendor's PR:N rating implies no special privileges are needed beyond running code locally; defenders should note that an OOB write in a media codec can sometimes be chained with other bugs to escalate impact, so it should not be dismissed despite the medium score. No EPSS score was provided, so exploitation-probability modeling cannot corroborate the low-urgency read from KEV/POC absence.

A malicious application installed on an affected Samsung device (or a local process that can feed data into the media stack) supplies a specially crafted FLAC audio stream to the libcodec2-sec-flacdec.so decoder, triggering an out-of-bounds memory write. No public exploit code is known, and the limited integrity/availability impact suggests the realistic outcome is memory corruption or a decoder crash rather than straightforward remote code execution.