Samsung Android CVE-2026-21116

Exploitation requires a local attacker on the device (AV:L) - typically a malicious or compromised app - able to feed a crafted Matroska/MKV-format media stream to the system media framework so that libsmkvextractor.so parses it. The out-of-bounds write is triggered during this extraction/parsing of attacker-controlled container data. Limiting factors: the attacker must already have local access/code execution on a Samsung device; impact is confined to LOW integrity and LOW availability with no confidentiality loss and no scope change, so this does not by itself grant privilege escalation or data theft. Devices patched to SMR Oct-2026 Release 1 or later are not affected.

This is a medium-severity (CVSS 4.0 base 5.1) memory-corruption flaw whose signals consistently point to limited, not widespread, real-world risk. The CVSS vector is the strongest available signal and indicates a LOCAL attack vector (AV:L) with low complexity (AC:L) and no privileges or user interaction (PR:N/UI:N), but impact is constrained to LOW integrity and LOW availability (VI:L/VA:L) with NO confidentiality impact (VC:N) and no scope change - consistent with an out-of-bounds write that can corrupt memory or crash the extractor rather than yield full code execution or data disclosure. No EPSS score, no CISA KEV listing, and no public exploit were provided, so there is no public exploit identified at time of analysis; the absence of these signals reinforces that this is not an active-exploitation priority. No SSVC decision data was supplied. The key tension is that AV:L caps real-world risk: despite PR:N/UI:N (which in isolation sound severe), exploitation requires the attacker to already have a local foothold (e.g., a malicious or compromised app) on the device, and the LOW/LOW impact means successful exploitation does not directly compromise the whole device. CWE is listed as N/A, but the description ('out-of-bounds write') and the 'Buffer Overflow' tag align, so the weakness class is confirmable from the description. Overall: a legitimate bug to patch via the Samsung monthly update, but not an emergency - more a defense-in-depth fix than a widely exploited critical flaw.

A malicious or compromised application installed on a Samsung device supplies a crafted Matroska/MKV media stream to the system media framework, which routes it to libsmkvextractor.so for parsing. A malformed field in the container triggers an out-of-bounds write during extraction, corrupting adjacent memory to crash the media service or tamper with process memory. No public proof-of-concept was provided, and the local attack vector (AV:L) with low complexity means the attacker must first have local code execution on the device.