EUVD-2026-55086
GHSA-chqx-m383-qf48
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable with mandatory user interaction (UI:R) and high complexity; strictly confidentiality impact (C:H) as SIM data is exposed with no integrity or availability effect.
Primary rating from Vendor (SamsungMobile).
CVSS VectorVendor: SamsungMobile
Lifecycle Timeline
2DescriptionCVE.org
Improper input validation in Samsung Dialer prior to SMR Aug-2026 Release 1 allows remote attackers to access SIM related functions. User interaction is required for triggering this vulnerability.
AnalysisAI
Samsung Dialer on Samsung Mobile Devices prior to SMR Aug-2026 Release 1 exposes SIM-related functions to remote attackers through improper input validation, requiring user interaction to trigger. The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:P/VC:H) classifies this as a network-reachable, high-confidentiality-impact flaw, though high attack complexity and specific prerequisites substantially reduce the realistic threat surface. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Technical ContextAI
Samsung Dialer is the native telephony application preinstalled on Samsung Galaxy devices, identified under CPE cpe:2.3:a:samsung_mobile:samsung_mobile_devices. SIM-related functions in Android telephony stacks (accessible via the TelephonyManager and SIM APIs) typically expose sensitive subscriber data such as IMSI, ICCID, and carrier provisioning details, which are ordinarily protected by Android permission boundaries. The vulnerability arises from improper input validation - no specific CWE is assigned, but the root cause class is consistent with CWE-20 - allowing crafted attacker-controlled input reaching the Dialer to bypass expected access control gates on these telephony APIs. The CVSS 4.0 AT:P metric confirms that specific attack prerequisites must be present, suggesting the vulnerable code path is only reachable under particular device states or Dialer interactions.
RemediationAI
Apply Samsung Mobile Security Maintenance Release (SMR) Aug-2026 Release 1 or later, distributed through the standard Samsung over-the-air update mechanism (Settings > Software Update > Download and Install). The vendor advisory confirming the fix is at https://security.samsungmobile.com/securityUpdate.smsb?year=2026&month=08. Until patched, users - particularly those in high-risk roles - should avoid interacting with unsolicited phone calls, SMS messages, or deep links that invoke the Dialer application from unknown sources, as user interaction is a required step in the attack chain. Disabling automatic link previews or caller-ID lookups in the Dialer settings may reduce the attack surface, though Samsung has not provided a specific official workaround. Mobile threat defense (MTD) solutions that monitor abnormal Dialer API invocations could provide detection capability in the interim.
More in Samsung Mobile Devices
View allOut-of-bounds write in Samsung's Keymaster trustlet - a Trusted Execution Environment (TEE) component running in ARM Tru
Local privilege escalation to root in Samsung's DualDAR (Dual Data-at-Rest) encryption component affects Samsung mobile
Remote code execution in Samsung Mobile Devices arises from a heap-based buffer overflow in the JPEG decoding path of li
Remote code execution in the DNG (Adobe Digital Negative) image decoder within Samsung's Quram imaging library (libimage
Path traversal in Samsung's ImsService (IP Multimedia Subsystem Service) on Android 14 through 17 permits remote unauthe
Out-of-bounds write in libmdnie.so on Samsung Mobile Devices running Android 15, 16, and 17 enables local attackers to e
Local privilege escalation in Samsung Galaxy Watch allows unprivileged local attackers to execute arbitrary code with sy
Stack-based buffer overflow in libril_sem.so - Samsung's Radio Interface Layer shared library - enables privileged local
Improper input validation in Samsung's DualDAR kernel driver enables a local privileged attacker to escalate privileges
We need to produce a comprehensive analysis for CVE-2026-21047. Let's gather all provided data: CVE ID, description: "Ou
Google's Secure Folder prior to the March 2026 SMR release improperly exports Android application components, enabling l
Heap buffer overflow in Samsung KnoxVault trustlet (hwvault trusted application) on Samsung Mobile Devices prior to SMR
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today