Samsung Camera EUVD-2026-21872

Q: What is the CVSS score of EUVD-2026-21872?

EUVD-2026-21872 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-21014 MEDIUM

2026-04-13 SamsungMobile

GHSA-mjx3-57hm-4rw6

Information Disclosure Samsung Samsung Camera Samsung Mobile

5.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Apr 13, 2026 - 06:29 vuln.today

CVSS changed

Apr 13, 2026 - 06:22 NVD

5.1 (MEDIUM)

EUVD ID Assigned

Apr 13, 2026 - 06:15 euvd

EUVD-2026-21872

Analysis Generated

Apr 13, 2026 - 06:15 vuln.today

CVE Published

Apr 13, 2026 - 05:04 nvd

MEDIUM 5.1

DescriptionCVE.org

Improper access control in Samsung Camera prior to version 16.5.00.28 allows local attacker to access location data. User interaction is required for triggering this vulnerability.

AnalysisAI

Samsung Camera prior to version 16.5.00.28 allows local attackers with limited privileges to access device location data through improper access control, requiring user interaction to trigger. This information disclosure vulnerability affects Samsung's mobile camera application and represents a localized privacy exposure on affected devices.

Technical ContextAI

The vulnerability stems from inadequate access control mechanisms within Samsung Camera's handling of location data access. The affected component fails to properly restrict access to location information when invoked by processes with limited user privileges (PR:L in CVSS vector). The attack requires local system access (AV:L) and user interaction (UI:A), indicating the attacker must already have presence on the device and potentially require user action to trigger data exposure. This is classified as an information disclosure vulnerability affecting confidentiality (VC:H) without integrity or availability impact.

RemediationAI

Samsung has released a patched version: upgrade Samsung Camera to version 16.5.00.28 or later. Users should install this update through the Samsung Galaxy Store or automatic update mechanisms on their mobile devices. No workarounds are available to mitigate the access control flaw without applying the official patch. Complete advisory information and technical details are provided by Samsung Mobile Security at https://security.samsungmobile.com/serviceWeb.smsb?year=2026&month=04.