Samsung Mobile Devices EUVD-2026-55091

Q: What is the CVSS score of EUVD-2026-55091?

EUVD-2026-55091 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2026-21066 MEDIUM

Improper Input Validation (CWE-20)

2026-08-10 SamsungMobile

GHSA-qr93-xw8j-6gx7

Buffer Overflow Samsung Mobile Devices Samsung Mobile

5.1

CVSS 4.0 · Vendor: SamsungMobile

Severity by source

Vendor (SamsungMobile) PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.8 MEDIUM

Local vector per description; PR:N per CVSS 4.0 input; scope change (S:C) inferred from subsequent-system impact metrics (SC:L/SI:L/SA:L) in the provided CVSS 4.0 vector.

3.1 AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L

Primary rating from Vendor (SamsungMobile).

CVSS VectorVendor: SamsungMobile

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 10, 2026 - 09:05 vuln.today

CVE Published

Aug 10, 2026 - 07:41 cve.org

MEDIUM 5.1

DescriptionCVE.org

Improper input validation in libcodec2_sec_flacdec.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory.

AnalysisAI

Out-of-bounds memory write in Samsung's libcodec2_sec_flacdec.so FLAC decoder library exposes Samsung Mobile Devices to local exploitation on firmware prior to the SMR Aug-2026 Release 1 patch. The root cause is improper input validation in the secure FLAC decoding component, allowing a local attacker to write beyond allocated memory boundaries and potentially corrupt adjacent memory. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists for this CVE.

Technical ContextAI

The affected component is libcodec2_sec_flacdec.so, a Samsung-proprietary shared library implementing FLAC (Free Lossless Audio Codec) decoding; the 'sec' designation indicates operation in a privileged or trusted codec process context. The vulnerability arises from insufficient bounds checking on input data before writing to memory buffers - a pattern consistent with CWE-787 (Out-of-Bounds Write), though no CWE was formally assigned in the available data. The CVSS 4.0 vector's subsequent-system impact metrics (SC:L/SI:L/SA:L) suggest limited cross-process or cross-privilege-boundary effects, which is consistent with a codec library that may run in an isolated but trusted media process. The CPE cpe:2.3:a:samsung_mobile:samsung_mobile_devices:*:*:*:*:*:*:*:* covers all Samsung Mobile Devices prior to the August 2026 security maintenance release.

RemediationAI

Apply the SMR Aug-2026 Release 1 security update, which contains the vendor-released patch for this vulnerability. Users should navigate to Settings > Software Update > Download and Install on their Samsung devices. The full advisory is available at https://security.samsungmobile.com/securityUpdate.smsb?year=2026&month=08. For managed enterprise fleets pending patch deployment, administrators can reduce attack surface by enforcing policies that block sideloading of untrusted media files and restrict third-party app installation, thereby limiting local attacker access to the vulnerable FLAC decoder; note these controls reduce exposure but do not eliminate the vulnerability. No direct workaround addressing the underlying out-of-bounds write in libcodec2_sec_flacdec.so is known.