EUVD-2026-55083
GHSA-q5p9-3rc7-39gw
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector with no privileges required since any installed app can invoke Samsung Contacts IPC; high integrity impact from unauthorized file deletion; no confidentiality or availability impact per vendor-provided description and CVSS 4.0 scoring.
Primary rating from Vendor (SamsungMobile).
CVSS VectorVendor: SamsungMobile
Lifecycle Timeline
2DescriptionCVE.org
Improper input validation in Samsung Contacts prior to SMR Aug-2026 Release 1 allows local attackers to delete file with Samsung Contacts' privilege.
AnalysisAI
Improper input validation in Samsung Contacts on Samsung Mobile devices prior to SMR Aug-2026 Release 1 enables local attackers to delete files under Samsung Contacts' process privilege, bypassing the Android sandbox boundary between applications. The CVSS 4.0 score of 6.9 with VI:H reflects high integrity impact on the vulnerable system, though the local attack vector constrains opportunistic exploitation. No public exploit code exists and the vulnerability is not listed in CISA KEV at time of analysis; Samsung has released a fix in the August 2026 Security Maintenance Release.
Technical ContextAI
Samsung Contacts is a native application bundled with Samsung Mobile devices (CPE: cpe:2.3:a:samsung_mobile:samsung_mobile_devices) that runs within its own Android sandbox with a dedicated UID and a specific set of file system permissions for contact databases, vCards, and associated media. The flaw arises from failure to validate attacker-controlled input before using it in file system operations - a pattern consistent with CWE-20 (Improper Input Validation) or potentially CWE-73 (External Control of File Name or Path), though no CWE was formally assigned by the reporter. On Android, inter-process communication mechanisms such as Intents and Content Providers can be crafted by any installed application; if Samsung Contacts processes IPC-delivered input without proper validation, an attacker-controlled app can induce the Contacts process to perform file deletion operations on the attacker's behalf using the application's elevated file access rights. No CWE identifier was provided in the advisory data.
RemediationAI
The primary remediation is to apply Samsung's SMR Aug-2026 Release 1 security update, delivered via Samsung's over-the-air update mechanism or through carrier-specific distribution channels; the full advisory is at https://security.samsungmobile.com/securityUpdate.smsb?year=2026&month=08. No specific workarounds are documented in the available data. As a compensating control pending patch deployment, organizations managing Samsung device fleets via MDM can enforce policies that restrict sideloading of untrusted applications and limit app installation to approved sources such as corporate MDM profiles or the Samsung Galaxy Store; this reduces the probability that a malicious app can obtain the local foothold necessary to trigger the flaw, though it does not eliminate the risk from an attacker with physical device access. Restricting Samsung Contacts' IPC exposure via MDM app configuration policies, if supported, could further reduce the attack surface but may impact legitimate contact-sharing functionality.
More in Samsung Mobile Devices
View allOut-of-bounds write in Samsung's Keymaster trustlet - a Trusted Execution Environment (TEE) component running in ARM Tru
Local privilege escalation to root in Samsung's DualDAR (Dual Data-at-Rest) encryption component affects Samsung mobile
Remote code execution in Samsung Mobile Devices arises from a heap-based buffer overflow in the JPEG decoding path of li
Remote code execution in the DNG (Adobe Digital Negative) image decoder within Samsung's Quram imaging library (libimage
Path traversal in Samsung's ImsService (IP Multimedia Subsystem Service) on Android 14 through 17 permits remote unauthe
Out-of-bounds write in libmdnie.so on Samsung Mobile Devices running Android 15, 16, and 17 enables local attackers to e
Local privilege escalation in Samsung Galaxy Watch allows unprivileged local attackers to execute arbitrary code with sy
Stack-based buffer overflow in libril_sem.so - Samsung's Radio Interface Layer shared library - enables privileged local
Improper input validation in Samsung's DualDAR kernel driver enables a local privileged attacker to escalate privileges
Memory corruption in Samsung's proprietary ImsService - the IP Multimedia Subsystem component handling VoLTE, Wi-Fi Call
Google's Secure Folder prior to the March 2026 SMR release improperly exports Android application components, enabling l
Heap buffer overflow in Samsung KnoxVault trustlet (hwvault trusted application) on Samsung Mobile Devices prior to SMR
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today