EUVD-2026-29904
GHSA-rf32-rw6v-wv3p
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local-only vector with high privileges required; no confidentiality impact; high integrity and availability impact from arbitrary code execution in SveService.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Out-of-bounds write in SveService prior to SMR May-2026 Release 1 allows local privileged attackers to execute arbitrary code.
AnalysisAI
Out-of-bounds memory write in Samsung's SveService component allows local attackers holding high privileges to execute arbitrary code on affected devices. Impacting Samsung Mobile Devices running Android 14, 15, and 16 prior to SMR May-2026 Release 1, exploitation is constrained to local privileged actors, substantially limiting real-world attack surface. No public exploit code exists and no confirmed active exploitation has been reported; EPSS places this at the 3rd percentile (0.01%), consistent with the elevated barrier to entry.
Technical ContextAI
SveService is a privileged Samsung system-level service running on Samsung Mobile Devices across Android 14, 15, and 16 generations (CPE: cpe:2.3:a:samsung_mobile:samsung_mobile_devices). The root cause is CWE-787 (Out-of-Bounds Write): the service fails to properly validate the bounds of a memory write operation, permitting an attacker-controlled value to write data beyond the intended buffer boundary. On modern Android, this class of flaw in a privileged service can allow an attacker with existing system-level or privileged-app access to corrupt adjacent memory structures, overwrite function pointers or return addresses, and redirect execution flow to attacker-controlled code. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:H/UI:N) confirms the local-only, high-privilege-required attack surface with no special attack requirements (AT:N) and no need for user interaction.
RemediationAI
The primary remediation is to apply the Samsung Monthly Security Release for May 2026 (SMR May-2026 Release 1), which contains the patch for this vulnerability across Android 14, 15, and 16. Device owners and MDM administrators should verify OTA update status and enforce prompt update adoption via policy. The vendor advisory is at https://security.samsungmobile.com/securityUpdate.smsb?year=2026&month=05. Where patching cannot be immediately applied, compensating controls should focus on restricting the privilege level of third-party applications - specifically, preventing installation of apps requesting system-level or privileged permissions - and enabling Samsung Knox integrity monitoring if available, which may detect anomalous SveService behavior. Note that these controls reduce exposure but do not eliminate the vulnerability; patch application remains the definitive fix.
More in Samsung Mobile Devices
View allOut-of-bounds write in Samsung's Keymaster trustlet - a Trusted Execution Environment (TEE) component running in ARM Tru
Local privilege escalation to root in Samsung's DualDAR (Dual Data-at-Rest) encryption component affects Samsung mobile
Remote code execution in Samsung Mobile Devices arises from a heap-based buffer overflow in the JPEG decoding path of li
Remote code execution in the DNG (Adobe Digital Negative) image decoder within Samsung's Quram imaging library (libimage
Path traversal in Samsung's ImsService (IP Multimedia Subsystem Service) on Android 14 through 17 permits remote unauthe
Out-of-bounds write in libmdnie.so on Samsung Mobile Devices running Android 15, 16, and 17 enables local attackers to e
Local privilege escalation in Samsung Galaxy Watch allows unprivileged local attackers to execute arbitrary code with sy
Stack-based buffer overflow in libril_sem.so - Samsung's Radio Interface Layer shared library - enables privileged local
Improper input validation in Samsung's DualDAR kernel driver enables a local privileged attacker to escalate privileges
We need to produce a comprehensive analysis for CVE-2026-21047. Let's gather all provided data: CVE ID, description: "Ou
Google's Secure Folder prior to the March 2026 SMR release improperly exports Android application components, enabling l
Heap buffer overflow in Samsung KnoxVault trustlet (hwvault trusted application) on Samsung Mobile Devices prior to SMR
Same weakness CWE-787 – Out-of-bounds Write
View allShare
External POC / Exploit Code
Leaving vuln.today