Samsung WSM Service CVE-2026-21120

Requires local code execution on the affected Samsung mobile device: the attacker must already run as some process (typically a malicious or compromised app) able to reach the WSM service interface - remote network exploitation is not possible (AV:L). Exploitation further depends on triggering and winning the use-after-free's timing/memory-reuse condition (reflected by AT:P), so success is probabilistic rather than guaranteed on a single attempt. No user interaction and no prior authentication or privilege are needed (PR:N/UI:N). The main limiting factors are the local-access prerequisite plus race reliability; the fix ships in SMR Oct-2026 Release 1, so patched devices are not affected.

This is a genuine high-priority local privilege-escalation/code-execution issue, but not a drop-everything internet-facing emergency. The CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:N/UI:N) confirms it is locally exploitable by an unauthenticated process with no user interaction, and the impact metrics are maximal (VC:H/VI:H/VA:H plus subsequent-system SC:H/SI:H/SA:H), consistent with the description's claim of arbitrary code execution at system privilege. The AT:P (attack requirement present) value is the key nuance: a use-after-free typically must win a timing/memory-reuse condition, so reliable exploitation is not guaranteed on every attempt. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of in-the-wild exploitation. The 8.9 score therefore reflects worst-case impact (full system compromise) rather than demonstrated exploitation, and the local-only vector means an attacker must already run code on the device. Conflict to verify: the input tags list 'Denial Of Service' alongside 'RCE', but the vendor-described outcome is code execution with system privilege - DoS is at most a degraded secondary outcome of the same memory-corruption bug, not a distinct capability.

A malicious or compromised low-privilege app installed on a Samsung mobile device interacts with the WSM service in a way that triggers a use-after-free, then grooms the freed memory to hijack a dangling pointer. By winning the required timing/reuse condition, the attacker gains arbitrary code execution at system privilege, escaping the app sandbox. No public exploit code was identified in the provided data.