Samsung Message EUVD-2026-55095

Q: What is the CVSS score of EUVD-2026-55095?

EUVD-2026-55095 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2026-21070 MEDIUM

Improper Input Validation (CWE-20)

2026-08-10 SamsungMobile

GHSA-cqww-5wfg-hfpv

Information Disclosure Samsung Samsung Mobile Devices Samsung Mobile

5.1

CVSS 4.0 · Vendor: SamsungMobile

Severity by source

Vendor (SamsungMobile) PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.3 MEDIUM

Physical vector confirmed; no privileges required to initiate access; user interaction implied by UI:A in source vector; confidentiality-only impact with no integrity or availability effect.

3.1 AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:P/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (SamsungMobile).

CVSS VectorVendor: SamsungMobile

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Aug 10, 2026 - 09:06 vuln.today

CVE Published

Aug 10, 2026 - 07:41 cve.org

MEDIUM 5.1

DescriptionCVE.org

Improper input validation in Samsung Message prior to SMR Aug-2026 Release 1 allows physical attackers to access sensitive information.

AnalysisAI

Samsung Message on Android devices prior to SMR Aug-2026 Release 1 exposes sensitive user information to physical attackers through improper input validation. An attacker with physical access to an unlocked or accessible device can interact with the Samsung Message application to trigger the flaw and read confidential message content or related data. No public exploit code has been identified, and exploitation requires hands-on device access, limiting widespread automated abuse.

Technical ContextAI

Samsung Message is the default SMS/MMS messaging application shipped on Samsung Mobile Devices (CPE: cpe:2.3:a:samsung_mobile:samsung_mobile_devices:*:*:*:*:*:*:*:*). The vulnerability stems from improper input validation - a failure to sanitize or bound-check attacker-supplied input before processing - which allows unintended access to sensitive information stored or displayed by the application. No CWE was formally assigned, but the behavior aligns with CWE-20 (Improper Input Validation) or potentially CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The CVSS 4.0 vector (AV:P) confirms the attack requires physical proximity to the device, and UI:A indicates some user interaction is involved.

RemediationAI

Apply the Samsung SMR Aug-2026 Release 1 security update, which contains the fix for this vulnerability. Samsung device owners should navigate to Settings > Software Update and install the August 2026 monthly security patch when available for their device model. The vendor advisory at https://security.samsungmobile.com/securityUpdate.smsb?year=2026&month=08 confirms patch availability. As a compensating control prior to patching, organizations managing sensitive deployments should enforce device lock screen policies (strong PIN/biometric) and enable full-disk encryption to reduce the risk of physical access exploitation. These controls do not eliminate the vulnerability but substantially raise the bar for an attacker. No workaround that disables Samsung Message without impacting SMS functionality has been identified.