Samsung Wallpaper Service EUVD-2026-42814

Q: What is the CVSS score of EUVD-2026-42814?

EUVD-2026-42814 has a CVSS 4.0 base score of 6.7 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2026-21043 MEDIUM

2026-07-10 mobile.security@samsung.com

GHSA-xw53-mwm6-gh7q

Path Traversal

6.7

CVSS 4.0 · Vendor: samsung

Severity by source

Vendor (samsung) PRIMARY

6.7 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.4 MEDIUM

Local access and high privileges required per description; confidentiality-only impact with no scope change or integrity/availability effect.

3.1 AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (samsung).

CVSS VectorVendor: samsung

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 10, 2026 - 06:10 vuln.today

DescriptionCVE.org

Path traversal in Wallpaper service prior to SMR Jul-2026 Release 1 allows local privileged attackers to access files with system server privilege.

AnalysisAI

Path traversal in Samsung Mobile's Wallpaper service exposes arbitrary files readable under the system server privilege to local privileged attackers. Affected devices run Android 14, 15, and 16 with firmware prior to the SMR Jul-2026 Release 1. The CVSS 4.0 vector (AV:L/PR:H/VC:H) confirms a local, high-privilege attack path with confidentiality-only impact and no integrity or availability consequence. No public exploit code or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

The Wallpaper service is a system-level Android component responsible for managing and rendering device wallpapers. It runs under the system server process context, granting it elevated access to the filesystem. The vulnerability is a path traversal weakness - a failure to canonicalize or sanitize file path inputs - that allows a caller with sufficient OS privileges to supply a crafted path (e.g., using '../' sequences) that escapes the intended directory boundary and resolves to arbitrary files accessible by the system server UID. While no CWE is formally assigned, this maps conceptually to CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). Affected products are Samsung Mobile Devices across Android 14, 15, and 16 as reported by Samsung's mobile security team (mobile.security@samsung.com) and tracked under EUVD-2026-42814.

RemediationAI

Apply Samsung SMR Jul-2026 Release 1, which is the vendor-confirmed fix for Android 14, 15, and 16. Enterprise and MDM administrators should push this OTA update through fleet management tooling and verify firmware version compliance. As a compensating control prior to patching, restrict installation and execution of untrusted privileged applications and enforce Samsung Knox policies that limit which applications can invoke Wallpaper service APIs at elevated privilege levels - though this does not eliminate the vulnerability for applications that legitimately hold high privileges. Full remediation requires the firmware update; no configuration-only workaround fully closes the path traversal. Advisory details: https://security.samsungmobile.com/securityUpdate.smsb?year=2026&month=07.