Samsung Flow CVE-2026-21133

Requires local access to a device (Android/Windows host) with Samsung Flow installed at a version prior to 4.9.22.1; the attacker leverages a path traversal weakness to escape intended boundaries and read clipboard contents. Exploitation is limited by the local attack vector (AV:L) - remote exploitation is not possible - so a pre-existing local foothold such as a malicious installed application or interactive access is the primary prerequisite. No authentication or user interaction is required per the vendor vector (PR:N/UI:N), and the impact is confined to disclosure of clipboard data.

This is a genuinely moderate, low-urgency issue rather than a critical priority. The vendor-supplied CVSS 4.0 vector (AV:L/AC:L/PR:N/UI:N) describes a local attack vector requiring no privileges or user interaction, with only low confidentiality impact (VC:L) and no integrity or availability impact (VI:N/VA:N) - the sole consequence is unauthorized read access to clipboard data. The base score of 5.1 (medium) is consistent with a local information-disclosure flaw. No EPSS score, no CISA KEV listing, and no public proof-of-concept were provided in the intelligence, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The AV:L designation is the key limiting factor: an attacker must already have local access to the device, which sharply constrains real-world exploitability compared with a network-reachable bug. No CWE was supplied (CWE: N/A), though the description and 'Path Traversal' tag point to CWE-22. Signals are internally consistent - nothing here suggests a high-CVSS-but-low-real-risk mislabel; rather it is a correctly-scored medium-severity local disclosure issue.

A malicious or compromised app already running locally on a device with Samsung Flow installed (prior to 4.9.22.1) abuses a path traversal flaw to reach and read clipboard data it should not have access to, potentially capturing copied passwords, 2FA codes, or other sensitive text. No public exploit code is known, and because the attack vector is local, the attacker must already have a foothold on the device.