EUVD-2026-55085
GHSA-m24q-hjpq-c7v2
Severity by source
CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Physical access required (AV:P), no authentication at Contacts level (PR:N), scope change (S:C) reflects cross-profile data access with high confidentiality impact; no integrity or availability impact applies.
Primary rating from Vendor (SamsungMobile).
CVSS VectorVendor: SamsungMobile
Lifecycle Timeline
2DescriptionCVE.org
Improper input validation in Samsung Contacts prior to SMR Aug-2026 Release 1 allows physical attackers to access data across multiple user profiles.
AnalysisAI
Samsung Contacts on Samsung Mobile Devices prior to SMR Aug-2026 Release 1 exposes contact data across Android user profiles to an attacker with physical device access, due to improper input validation that fails to enforce inter-profile data isolation. The CVSS 4.0 vector confirms both the physical access prerequisite (AV:P) and the scope extension to a secondary user's data (SC:H), consistent with a profile boundary bypass in a multi-user Android environment. No public exploit code or active exploitation has been identified at time of analysis.
Technical ContextAI
Samsung Contacts is a pre-installed application on Samsung Mobile Devices (CPE: cpe:2.3:a:samsung_mobile:samsung_mobile_devices:*:*:*:*:*:*:*:*) that manages phonebook and contact records. Android natively supports multiple user profiles - such as a device owner, secondary user, and work profile - each with isolated data stores. The vulnerability involves improper input validation within Samsung Contacts that allows crafted interactions by a physically present attacker to cross the kernel-enforced profile boundary and read contact data belonging to a different user profile. The CVSS 4.0 SC:H metric (subsequent system confidentiality high) confirms that the data exposed belongs to a system or profile outside the attacker's own security domain. No CWE has been assigned, which limits root-cause classification - the class is most likely an access control or boundary validation failure, but this cannot be confirmed from available data.
RemediationAI
The primary fix is to apply the August 2026 Samsung Security Maintenance Release (SMR Aug-2026 Release 1), which includes the patched version of Samsung Contacts. Users and administrators should navigate to Settings > Software Update on affected Samsung devices and install the available update. The vendor advisory is at https://security.samsungmobile.com/securityUpdate.smsb?year=2026&month=08. For environments where patching cannot be applied immediately, compensating controls include enforcing strict physical device security policies (locked storage, no unattended device access), disabling the use of secondary Android user profiles on sensitive or shared devices to eliminate the cross-profile data exposure entirely (trade-off: removes multi-user functionality), and ensuring strong device lock screen authentication to delay unauthorized physical interaction. Removing or disabling secondary user profiles is the most effective workaround when patching is delayed.
More in Samsung Mobile Devices
View allOut-of-bounds write in Samsung's Keymaster trustlet - a Trusted Execution Environment (TEE) component running in ARM Tru
Local privilege escalation to root in Samsung's DualDAR (Dual Data-at-Rest) encryption component affects Samsung mobile
Remote code execution in Samsung Mobile Devices arises from a heap-based buffer overflow in the JPEG decoding path of li
Remote code execution in the DNG (Adobe Digital Negative) image decoder within Samsung's Quram imaging library (libimage
Path traversal in Samsung's ImsService (IP Multimedia Subsystem Service) on Android 14 through 17 permits remote unauthe
Out-of-bounds write in libmdnie.so on Samsung Mobile Devices running Android 15, 16, and 17 enables local attackers to e
Local privilege escalation in Samsung Galaxy Watch allows unprivileged local attackers to execute arbitrary code with sy
Stack-based buffer overflow in libril_sem.so - Samsung's Radio Interface Layer shared library - enables privileged local
Improper input validation in Samsung's DualDAR kernel driver enables a local privileged attacker to escalate privileges
We need to produce a comprehensive analysis for CVE-2026-21047. Let's gather all provided data: CVE ID, description: "Ou
Google's Secure Folder prior to the March 2026 SMR release improperly exports Android application components, enabling l
Heap buffer overflow in Samsung KnoxVault trustlet (hwvault trusted application) on Samsung Mobile Devices prior to SMR
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today