Samsung Bixby EUVD-2026-55099

The attacker must have local, authenticated, low-privileged access to the target Samsung device - for example, via a malicious installed application or a user-level shell obtained through physical access or prior compromise. The Bixby service must be installed and running (the AT:P metric in the CVSS 4.0 vector confirms this specific attack requirement). No non-default configuration is required to be vulnerable: because the flaw is in the default permissions shipped with Bixby, any device running an unpatched version with Bixby active is exposed by design. Exploitation is strictly limited to the local attack vector - no network-based or remote unauthenticated attack path exists. The scope of impact is bounded to the Bixby process itself (SC:N/SI:N/SA:N), limiting lateral movement to capabilities held by the Bixby execution context rather than full device compromise.

The vendor-supplied CVSS 4.0 score of 7.2 reflects a high-severity local privilege escalation with full confidentiality and integrity impact on the vulnerable system, but no availability impact and no subsequent-system scope change. The local attack vector (AV:L) and low-privilege prerequisite (PR:L) materially constrain opportunistic exploitation - a remote, unauthenticated attacker cannot directly trigger this flaw. The AT:P metric further bounds exploitation to scenarios where the Bixby service is active. No EPSS data was supplied, and the absence of a CISA KEV listing combined with no identified public POC suggests no confirmed widespread active exploitation at time of analysis; however, the gap between CVSS severity and known exploitation activity is common for vendor-patched mobile platform issues and should not be read as low priority. The real-world blast radius is limited to Samsung device ecosystems, meaning even a mid-sized municipal IT team in legnica managing a Samsung Galaxy device fleet should treat this as a meaningful local privilege escalation requiring scheduled patch deployment rather than an emergency remote-threat response. The availability of a confirmed vendor patch at version 4.0.86.0 further reduces residual risk for organizations that can enforce device updates.

A malicious low-privileged application installed on a Samsung device, or an attacker with physical access and a user-level shell, identifies and abuses the incorrectly permissioned Bixby resource - such as a world-writable IPC socket or file - to inject commands that execute with Bixby's elevated system privileges. This allows the attacker to read sensitive voice assistant data or issue privileged commands beyond the scope of their original permissions. No public proof-of-concept code has been identified at time of analysis.