EUVD-2026-112562
GHSA-pw33-6fpc-cwfm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain privileged local foothold on device
-
DeliverySend crafted input to Bixby component
-
ExploitTrigger improper input validation
-
ExecutionLaunch arbitrary activity with Bixby's context
-
ImpactAccess or alter protected data/functions
Vulnerability Assessment
| Exploitation Conditions | Requires an attacker who already holds high local privileges (PR:H) on a Samsung device running Bixby prior to version 4.0.85.6; the flaw is reached by supplying unvalidated input to the Bixby component to launch an arbitrary activity. No user interaction is required (UI:N), but exploitation is strictly local (AV:L) and gated by the need for pre-existing elevated privileges - there is no remote or unauthenticated path, and the specific feature/interface exposing the unvalidated input is not detailed in the available sources. The only complete fix stated by the vendor is updating Bixby to 4.0.85.6 or later. |
| Impact | This is a genuine but bounded risk rather than an internet-facing emergency. The supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:H/UI:N, VC:H/VI:H/VA:L, score 8.3) describes a locally exploitable flaw that requires high privileges, low attack complexity, and no user interaction, with high confidentiality and integrity impact and limited availability impact confined to the vulnerable system (SC:N/SI:N/SA:N). The vuln.today decision label is 'this_week', indicating prompt but not immediate ('act_now'/'emergency') remediation urgency. There is no CISA KEV entry, no EPSS probability supplied, and no proof-of-concept or exploit reference in the provided data, so there is no public exploit identified at time of analysis. The requirement for pre-existing high privileges (PR:H) is the dominant limiting factor: an attacker must already hold a privileged local position on the device, which substantially narrows realistic exploitation to malicious or already-compromised privileged apps/processes rather than remote or drive-by attacks. Note a labeling tension: the Tags include 'Information Disclosure', but the description ('allows privileged local attackers to launch arbitrary activity') and the vector's VC:H AND VI:H both point to an integrity/activity-launch impact beyond pure disclosure - treat the impact as both confidentiality and integrity. |
| Exploit ScenarioDerived | A malicious or compromised app running with high privileges on a Samsung device passes crafted/unvalidated input to Bixby, which fails to properly validate it and launches an attacker-chosen activity. Because exploitation needs no user interaction and low complexity, a privileged local process could trigger it silently; no public exploit code is identified at this time. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 29, 2026
Improper input validation in Samsung Bixby before version 4.0.85.6 allows a local attacker who already holds high privileges on the device to launch arbitrary activities, giving a high impact on confidentiality and integrity and a limited impact on availability. Exploitation is strictly local and gated behind pre-existing elevated privileges, with no user interaction required and no remote or unauthenticated path described in the available sources. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and the vendor-reported severity is high (CVSS 8.3) while our assessed CVSS 3.1 vector is 6.5-class local, high-privilege impact; vuln.today prioritizes it as a this-week item rather than an emergency.
RemediationAI
Vendor-released patch: Bixby 4.0.85.6. Samsung states that updating Bixby to version 4.0.85.6 or later is the fix, and this is the only complete remediation the advisory describes; administrators and device owners should verify the installed Bixby version through the Galaxy Store or the device's application settings and push the update through their normal device management channel. No workaround, feature toggle or configuration-based mitigation is documented in the supplied advisory, so the fix should be treated as version-gated rather than configurable, and the residual exposure until devices are updated is limited to callers that already hold high local privileges. Full details and the vendor's bulletin are at https://security.samsungmobile.com/serviceWeb.smsb?year=2026&month=07.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Bixby is Samsung's on-device voice assistant that runs with system-level reach into Samsung Android devices, which is why the affected package is tracked under CPE cpe:2.3:a:samsung_mobile:bixby:*:*:*:*:*:*:*:* with all versions below 4.0.85.6 in scope. No CWE identifier was assigned in the supplied data, but the reported weakness is a failure to validate input before it is consumed by the Bixby component, which then permits the launch of arbitrary activities. The presence of PR:H in both the vendor CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L) and our assessed CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L) means the flaw is only reachable by a caller that already possesses high local privileges on the device; the vector does not encode any remote, network-adjacent or unauthenticated route. The trigger is not described in the available sources - the specific Bixby feature, intent handler or interface that accepts the unvalidated input is not disclosed, and the SSVC-style decision signal (this_week) plus the absence of KEV and of any EPSS value mean the practical risk is bounded by the local, high-privilege prerequisite rather than by exposure to the internet.
Know when Bixby gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
Local vector and PR:H because exploitation needs pre-existing privileged local access; AC:L and UI:N per vendor data; C:H/I:H from arbitrary activity launch, A:L for limited availability impact.
Primary rating from Vendor (SamsungMobile).
CVSS VectorVendor: SamsungMobile
DescriptionCVE.org
Improper input validation in Bixby prior to version 4.0.85.6 allows privileged local attackers to launch arbitrary activity.
Executive ViewAI
CVE-2026-21157 in Samsung Bixby could allow a local attacker with high privileges to launch arbitrary activities, potentially compromising confidentiality and integrity. However, exploitation requires pre-existing elevated privileges, limiting the threat to scenarios where an attacker already has significant control. Leadership should monitor for patches and ensure privileged access is tightly controlled.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting local high-privilege access, monitoring for suspicious activity from privileged accounts, and applying least-privilege policies.
Threat Intelligence Overview
NVD
CVE.org
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Improper handling of exceptional conditions in Bixby prior to version 3.0.53.02 allows attacker to execute the actions r
Incorrect default permissions in Samsung Bixby prior to version 4.0.86.0 allow a local attacker with low privileges to e
Improper handling of insufficient permission in Bixby wakeup prior to version 2.3.74.8 allows local attackers to access
Exploit-DB