Samsung Assistant EUVD-2026-34804

Q: What is the CVSS score of EUVD-2026-34804?

EUVD-2026-34804 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-21032 MEDIUM

2026-06-05 SamsungMobile

GHSA-57x5-6c8x-j77q

Information Disclosure Google Samsung Samsung Assistant Samsung Mobile

6.9

CVSS 4.0 · Vendor: SamsungMobile

Severity by source

Vendor (SamsungMobile) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (SamsungMobile) · only source for this CVE.

CVSS VectorVendor: SamsungMobile

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 13:37 vuln.today

CVSS changed

Jun 05, 2026 - 11:22 NVD

6.9 (MEDIUM)

CVE Published

Jun 05, 2026 - 10:15 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 05, 2026 - 10:15 nvd

MEDIUM 6.9

DescriptionCVE.org

Improper export of android application components in SmartHomeWidgetReceiver of Samsung Assistant prior to version 9.3.14 allows local attacker to execute arbitrary script.

AnalysisAI

Improper export of the SmartHomeWidgetReceiver Android component in Samsung Assistant prior to version 9.3.14 allows a local attacker without any privileges to send crafted intents directly to the exposed receiver and execute arbitrary scripts. The CVSS 4.0 score of 6.9 reflects high confidentiality impact (VC:H) constrained to the local attack surface (AV:L), aligning with the 'Information Disclosure' tag. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.

Technical ContextAI

This vulnerability involves an improperly exported Android BroadcastReceiver component named SmartHomeWidgetReceiver within Samsung Assistant. In Android, BroadcastReceiver components declared as exported without adequate permission enforcement are accessible to any other application on the device - any app can broadcast an intent targeting that component. The affected product is identified by CPE cpe:2.3:a:samsung_mobile:samsung_assistant:*:*:*:*:*:*:*:*, covering all versions prior to 9.3.14 on Android. No CWE was formally assigned, but the root cause aligns with CWE-926 (Improper Export of Android Application Components), which describes the class of vulnerabilities where Android components are accessible to untrusted callers beyond their intended scope due to missing or insufficient export restrictions or permission declarations in the AndroidManifest.

RemediationAI

The primary fix is to update Samsung Assistant to version 9.3.14 or later, which resolves the improper component export as confirmed by the Samsung Mobile Security advisory at https://security.samsungmobile.com/serviceWeb.smsb?year=2026&month=06 and EUVD-2026-34804. Vendor-released patch: 9.3.14. As a compensating control prior to patching, restricting installation of untrusted or sideloaded third-party applications using Android Enterprise policies or device management (MDM/EMM) reduces the risk of a malicious app invoking the exposed receiver - this does not eliminate the vulnerability but raises the attacker's required access bar. If SmartHome widget functionality is not required in the deployment environment, disabling or restricting the SmartHome feature in Samsung Assistant may reduce the component's activation surface, though the specific configuration option is not detailed in available data and side effects on Samsung Assistant functionality should be assessed before applying.