Samsung Mobile CVE-2026-21119

Exploitation requires local code execution on an affected Samsung mobile device at low privilege (PR:L) - typically a malicious or compromised app - that can reach and supply crafted input to the native AI sound-separation library lib_sag_ai_sound_sep_v2.00.so. There is no remote or network path (AV:L) and no user interaction is needed (UI:N). Limiting factors: the attacker must already hold a local low-privileged foothold, the device must run firmware prior to SMR Oct-2026 Release 1, and the affected library must be present/invokable on the specific Samsung model; impact is bounded to low confidentiality/integrity/availability within the component.

This is a moderate-severity, locally-exploitable memory-safety flaw, not a high-priority remote threat. The vendor-supplied CVSS 4.0 vector (AV:L/AC:L/PR:L/UI:N) and the 4.8 base score are internally consistent with the description's 'local attackers' language - there is no conflict between the metrics and the narrative, which strengthens confidence in the local attack surface. Impact is bounded: VC:L/VI:L/VA:L indicates only low confidentiality, integrity, and availability impact with no scope change (SC:N/SI:N/SA:N), consistent with an out-of-bounds read/write that likely yields limited information disclosure or memory corruption within the context of the component rather than full device compromise. No EPSS score, KEV listing, or POC indicator is present in the supplied data, so there is no public exploitation signal. The practical risk is therefore that of a local privilege/memory issue requiring an already-present low-privileged app or local code execution foothold - a useful link in an exploit chain but not a standalone critical risk. EPSS and exploitation-automatability signals are simply absent here (not low), so they should not be read as evidence of safety; verify against the Samsung advisory and NVD once enrichment is available.

A malicious or compromised low-privileged application already installed on a Samsung mobile device invokes the AI sound-separation library (lib_sag_ai_sound_sep_v2.00.so) with crafted input, triggering an out-of-bounds read and write in the component. The attacker leverages the memory corruption to disclose adjacent memory or corrupt library state, potentially as one stage of a larger local privilege-escalation chain. No public exploit code is identified at time of analysis.