Samsung CocktailBarService CVE-2026-21117

Exploitation requires the attacker to already have local code execution on the Samsung device - in practice a malicious or compromised app installed and running on the handset - which then abuses the improper access control in CocktailBarService to read sensitive data. No authentication or user interaction is needed once the app is present (PR:N/UI:N), but the attack is strictly local (AV:L), so it cannot be performed remotely or over the network; the device must be running a Samsung build prior to SMR Oct-2026 Release 1. The requirement to first get an app onto the device, combined with impact limited to confidentiality of some data, meaningfully constrains real-world severity.

This is a moderate, locally-exploitable information-disclosure flaw rather than a top-priority remote threat. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:N) scores 5.1 and indicates a local attack surface requiring no privileges, no user interaction, and no special attack requirements - but the impact is confined to a low confidentiality loss (VC:L) with no integrity or availability effect. On Samsung's Android platform, 'local attacker' with PR:N realistically means a malicious or sideloaded app already running on the device that abuses the improperly-access-controlled CocktailBarService to read data it should not reach. No EPSS score was provided, the CVE is not on the CISA KEV list, and no public exploit code is referenced, so there is no evidence of active exploitation. The signals are internally consistent (local vector matches 'local attackers' in the description), so no contradiction needs flagging; the main caveat is that the vendor advisory content was not retrieved, so the exact sensitive data exposed and precise CWE are not independently confirmed.

A user installs a seemingly benign third-party app from outside the Play Store on their Samsung device. Because CocktailBarService enforces access control improperly, the app - holding no special permissions - queries the service and reads sensitive information belonging to other apps or the system. No public exploit code is identified at time of analysis, and exploitation requires the attacker to already have code execution as a local app on the handset.