EUVD-2026-55089
GHSA-322v-vc36-f6h9
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector with no privilege requirement confirmed by CVSS 4.0 source; no confidentiality impact per VC:N; integrity and availability both high per description of device inoperability.
Primary rating from Vendor (SamsungMobile).
CVSS VectorVendor: SamsungMobile
Lifecycle Timeline
2DescriptionCVE.org
Improper access control in Weaver prior to SMR Aug-2026 Release 1 allows local attackers to cause device inoperability.
AnalysisAI
Improper access control in the Weaver component of Samsung Mobile devices allows a local attacker without elevated privileges to render the device inoperable, achieving high integrity and availability impact. All Samsung Mobile devices running Weaver prior to the SMR Aug-2026 Release 1 security update are affected. No public exploit code or active exploitation has been confirmed at time of analysis, but the low attack complexity and absence of privilege requirements lower the bar for abuse by a local threat actor.
Technical ContextAI
Weaver is an Android Keystore abstraction layer component embedded in Samsung Mobile devices, responsible for secure credential and key management operations at the OS level. The vulnerability stems from improper access control - the component fails to enforce sufficient authorization checks before permitting sensitive operations, allowing a local process or user to interact with Weaver in ways that cause the device to become inoperable. While no CWE identifier was assigned by the reporter, the root cause class maps most closely to CWE-284 (Improper Access Control) or CWE-732 (Incorrect Permission Assignment for Critical Resource). The affected product is identified via CPE as cpe:2.3:a:samsung_mobile:samsung_mobile_devices:*:*:*:*:*:*:*:* with no version constraint narrowed beyond the patch cutoff of SMR Aug-2026 Release 1. The 'Information Disclosure' tag in the source intelligence may reflect a tagging artifact, as the CVSS 4.0 vector specifies VC:N (no confidentiality impact), suggesting the primary confirmed impacts are integrity and availability disruption.
RemediationAI
The primary remediation is to apply the Samsung Mobile Security Update for August 2026 (SMR Aug-2026 Release 1), which contains the fix for this access control flaw in Weaver. Device owners and enterprise MDM administrators should push this update to all managed Samsung Mobile endpoints as part of the standard monthly Samsung SMR patch cycle. The vendor advisory at https://security.samsungmobile.com/securityUpdate.smsb?year=2026&month=08 provides the authoritative update reference. If immediate patching is not feasible, the most actionable compensating control is to restrict physical and logical access to affected devices - enforce device encryption, require screen lock with strong PIN or biometric, and limit installation of untrusted applications via MDM policy, since the attack vector requires local access. These controls raise the bar for exploitation but do not eliminate the underlying flaw; patching remains the definitive fix.
More in Samsung Mobile Devices
View allLocal privilege escalation to root in Samsung's DualDAR (Dual Data-at-Rest) encryption component affects Samsung mobile
Remote code execution in Samsung Mobile Devices arises from a heap-based buffer overflow in the JPEG decoding path of li
Remote code execution in the DNG (Adobe Digital Negative) image decoder within Samsung's Quram imaging library (libimage
Path traversal in Samsung's ImsService (IP Multimedia Subsystem Service) on Android 14 through 17 permits remote unauthe
Local privilege escalation in Samsung Galaxy Watch allows unprivileged local attackers to execute arbitrary code with sy
Out-of-bounds write in libmdnie.so on Samsung Mobile Devices running Android 15, 16, and 17 enables local attackers to e
Stack-based buffer overflow in libril_sem.so - Samsung's Radio Interface Layer shared library - enables privileged local
Improper input validation in Samsung's DualDAR kernel driver enables a local privileged attacker to escalate privileges
Out-of-bounds write in Samsung's Keymaster trustlet - a Trusted Execution Environment (TEE) component running in ARM Tru
We need to produce a comprehensive analysis for CVE-2026-21047. Let's gather all provided data: CVE ID, description: "Ou
Google's Secure Folder prior to the March 2026 SMR release improperly exports Android application components, enabling l
Heap buffer overflow in Samsung KnoxVault trustlet (hwvault trusted application) on Samsung Mobile Devices prior to SMR
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today