Samsung Mobile Devices EUVD-2026-55096

Q: What is the CVSS score of EUVD-2026-55096?

EUVD-2026-55096 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2026-21071 MEDIUM

Improper Input Validation (CWE-20)

2026-08-10 SamsungMobile

GHSA-q2h3-fgc6-2gqw

Buffer Overflow Samsung Mobile Devices Samsung Mobile

5.1

CVSS 4.0 · Vendor: SamsungMobile

Severity by source

Vendor (SamsungMobile) PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.8 MEDIUM

Local vector confirmed by description; PR:N because any unprivileged process invokes the codec; S:C reflects cross-component memory impact observed in SC/SI/SA of CVSS 4.0.

3.1 AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L

Primary rating from Vendor (SamsungMobile).

CVSS VectorVendor: SamsungMobile

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 10, 2026 - 09:08 vuln.today

CVE Published

Aug 10, 2026 - 07:41 cve.org

MEDIUM 5.1

DescriptionCVE.org

Improper input validation in MPEG4 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory.

AnalysisAI

Out-of-bounds memory write in Samsung Mobile Devices' MPEG4 codec library libsavsvc.so enables local attackers with no special privileges to corrupt memory, potentially leading to code execution or service disruption across affected system components. All Samsung Mobile Devices running firmware prior to SMR Aug-2026 Release 1 are exposed via this improper input validation flaw in the proprietary media codec. No public exploit code has been identified at time of analysis, but the low attack complexity and absence of privilege requirements lower the bar for exploitation on any affected device with an unprivileged app installed.

Technical ContextAI

The vulnerability resides in libsavsvc.so, a Samsung-proprietary shared library responsible for audio/video service codec operations on Samsung Mobile Devices. The MPEG4 codec within this library fails to properly validate input data before writing to memory - a classic Improper Input Validation root cause (consistent with the 'Buffer Overflow' tag applied to this CVE, indicative of CWE-787 Out-of-Bounds Write behavior even though no CWE is formally assigned). The CPE cpe:2.3:a:samsung_mobile:samsung_mobile_devices:*:*:*:*:*:*:*:* covers the full Samsung Mobile product line without version restriction, scoping the affected population to all devices prior to the August 2026 SMR. The CVSS 4.0 vector (AV:L) confirms the attack surface is local - an on-device application can invoke the vulnerable codec path by supplying a crafted MPEG4 stream to libsavsvc.so via standard media APIs.

RemediationAI

Apply the Samsung Security Maintenance Release (SMR) Aug-2026 Release 1 by updating device firmware via Settings > Software Update on affected Samsung devices - this is the only confirmed fix per the vendor advisory. The exact patched build identifier beyond 'SMR Aug-2026 Release 1' is not independently confirmed from available data; consult https://security.samsungmobile.com/securityUpdate.smsb?year=2026&month=08 for device-specific build strings. As a compensating control prior to patching, mobile device management (MDM) policies that restrict installation of untrusted or sideloaded applications reduce the local attack surface, since exploitation requires a local process to feed crafted MPEG4 input to the codec - this does not eliminate the underlying flaw but meaningfully raises the bar for exploitation in managed environments.