EUVD-2026-29906
GHSA-wv49-fmc3-hf27
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector with PR:N because any co-resident Android app can send intents to exported components without elevated privileges; low C/I/A impacts reflect partial, bounded effect on device configuration data.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Improper export of android application components in OmaCP prior to SMR May-2026 Release 1 allows local attackers to trigger privileged functions.
AnalysisAI
OmaCP on Samsung Android devices (Android 14, 15, and 16) exposes improperly exported application components that allow any co-resident local application to invoke privileged functions without holding the required permissions. The flaw is rooted in Android's IPC mechanism, where components lacking proper access control declarations can be targeted by crafted intents from other installed apps. No public exploit code has been identified at the time of analysis, and EPSS sits at 0.01% (3rd percentile), consistent with SSVC's exploitation status of none; risk is real but bounded by the local attack vector.
Technical ContextAI
OmaCP is a Samsung Mobile application implementing OMA (Open Mobile Alliance) Client Provisioning, used to push and apply carrier-side device configuration - a function with access to sensitive provisioning operations. Android application components (Activities, Services, BroadcastReceivers, ContentProviders) may be declared as exported via android:exported='true' or by including an intent-filter without an android:permission guard, making them reachable by any app on the device. Without proper permission enforcement on these components, a malicious co-resident app can dispatch crafted intents to trigger privileged provisioning or configuration functions. This vulnerability class maps to CWE-926 (Improper Export of Android Application Components), though no CWE is formally assigned in the NVD entry. The CPE is cpe:2.3:a:samsung_mobile:samsung_mobile_devices:*:*:*:*:*:*:*:*, and the 'Google' tag suggests coordinated disclosure potentially involving Android's security team.
RemediationAI
Apply Samsung's SMR May-2026 Release 1, which patches the improper component export in OmaCP for Android 14, 15, and 16. Device owners should verify the May 2026 security patch level is applied via Settings > Software Update or Settings > About Phone > Software Information. Enterprise administrators managing Samsung fleets should confirm patch deployment through their Mobile Device Management (MDM) solution. As a compensating control before patching, restrict installation of untrusted third-party applications using MDM policies or Google Play Protect enforcement - this reduces the likelihood of a malicious app being present to exploit the exported component, though it does not eliminate the underlying flaw. Full vendor advisory details are at https://security.samsungmobile.com/securityUpdate.smsb?year=2026&month=05.
More in Samsung Mobile Devices
View allOut-of-bounds write in Samsung's Keymaster trustlet - a Trusted Execution Environment (TEE) component running in ARM Tru
Local privilege escalation to root in Samsung's DualDAR (Dual Data-at-Rest) encryption component affects Samsung mobile
Remote code execution in Samsung Mobile Devices arises from a heap-based buffer overflow in the JPEG decoding path of li
Remote code execution in the DNG (Adobe Digital Negative) image decoder within Samsung's Quram imaging library (libimage
Path traversal in Samsung's ImsService (IP Multimedia Subsystem Service) on Android 14 through 17 permits remote unauthe
Out-of-bounds write in libmdnie.so on Samsung Mobile Devices running Android 15, 16, and 17 enables local attackers to e
Local privilege escalation in Samsung Galaxy Watch allows unprivileged local attackers to execute arbitrary code with sy
Stack-based buffer overflow in libril_sem.so - Samsung's Radio Interface Layer shared library - enables privileged local
Improper input validation in Samsung's DualDAR kernel driver enables a local privileged attacker to escalate privileges
We need to produce a comprehensive analysis for CVE-2026-21047. Let's gather all provided data: CVE ID, description: "Ou
Google's Secure Folder prior to the March 2026 SMR release improperly exports Android application components, enabling l
Heap buffer overflow in Samsung KnoxVault trustlet (hwvault trusted application) on Samsung Mobile Devices prior to SMR
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today