EUVD-2026-29905
GHSA-mwvv-x94p-96gq
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
Improper input validation in FacAtFunction in Galaxy Watch prior to SMR May-2026 Release 1 allows local attacker to execute arbitrary code with system privilege.
AnalysisAI
Local privilege escalation in Samsung Galaxy Watch allows unprivileged local attackers to execute arbitrary code with system-level privileges by exploiting improper input validation in the FacAtFunction component. Affects Galaxy Watch devices running Android Watch 14 and 16 prior to Samsung's May 2026 security release (SMR May-2026 Release 1). EPSS score of 0.03% indicates low automated exploitation probability, and no active exploitation or public POC has been identified at time of analysis. Attack requires physical or ADB access to the device.
Technical ContextAI
The vulnerability resides in FacAtFunction, a Samsung-specific component in the Galaxy Watch firmware that appears to handle AT command processing or factory testing functions. The flaw stems from improper input validation - a class of vulnerabilities where user-supplied data is not sufficiently sanitized before being processed by privileged system functions. The CVSS 4.0 vector (AV:L/AC:L/PR:N) indicates local access with low attack complexity and no privileges required, suggesting the vulnerable function is accessible to unprivileged processes or through debugging interfaces like ADB. The affected platform is Samsung's Android-based wearable OS (Wear OS variants for Android Watch 14 and 16), which runs a modified Android stack with Samsung proprietary components. CPE data identifies the vulnerability scope as Samsung Mobile Devices ecosystem, specifically the Galaxy Watch product line.
RemediationAI
Apply Samsung Mobile Security Release May 2026 Release 1 or later through the Galaxy Wearable app on paired smartphones or via direct device system update (Settings > Software update > Download and install). Samsung distributes wearable OS updates through staged rollout, so availability varies by region and carrier. Users can check current security patch level in Settings > About watch > Software information > Security software version - must show May 2026 or later. Until patched, compensating controls include: disable USB debugging in Developer options to prevent ADB-based exploitation (trade-off: limits legitimate development and troubleshooting); restrict installation of apps to Galaxy Store only via Settings > Apps > App permissions > Special access > Install unknown apps (reduces malicious app vector but blocks sideloading); enable PIN/password device lock to prevent unauthorized physical access (does not protect against exploit via malicious app but raises attack complexity). No workaround fully mitigates the vulnerability - patching is the only complete remediation.
More in Samsung Mobile Devices
View allOut-of-bounds write in Samsung's Keymaster trustlet - a Trusted Execution Environment (TEE) component running in ARM Tru
Local privilege escalation to root in Samsung's DualDAR (Dual Data-at-Rest) encryption component affects Samsung mobile
Remote code execution in Samsung Mobile Devices arises from a heap-based buffer overflow in the JPEG decoding path of li
Remote code execution in the DNG (Adobe Digital Negative) image decoder within Samsung's Quram imaging library (libimage
Path traversal in Samsung's ImsService (IP Multimedia Subsystem Service) on Android 14 through 17 permits remote unauthe
Out-of-bounds write in libmdnie.so on Samsung Mobile Devices running Android 15, 16, and 17 enables local attackers to e
Stack-based buffer overflow in libril_sem.so - Samsung's Radio Interface Layer shared library - enables privileged local
Improper input validation in Samsung's DualDAR kernel driver enables a local privileged attacker to escalate privileges
We need to produce a comprehensive analysis for CVE-2026-21047. Let's gather all provided data: CVE ID, description: "Ou
Google's Secure Folder prior to the March 2026 SMR release improperly exports Android application components, enabling l
Heap buffer overflow in Samsung KnoxVault trustlet (hwvault trusted application) on Samsung Mobile Devices prior to SMR
Improper access control in the Weaver component of Samsung Mobile devices allows a local attacker without elevated privi
Share
External POC / Exploit Code
Leaving vuln.today