EUVD-2026-97186
GHSA-v8xc-q823-59gq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInstall malicious app on device
-
ExploitInvoke Samsung TTS with crafted input
-
ExecutionTrigger out-of-bounds write in libsamsungtts.so
-
ImpactExecute arbitrary code in TTS context
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires local access to a Samsung Android device running a build prior to SMR Oct-2026 Release 1 - typically a malicious or compromised app (or local process) that can invoke the Samsung TTS engine and feed it crafted input to trigger the out-of-bounds write in libsamsungtts.so. Although the vector is PR:N/UI:N (no special privileges or user interaction beyond normal TTS invocation), the AV:L requirement is itself the key limiting factor: there is no remote/network path, so the attacker must already have code running on the device. Devices updated to SMR Oct-2026 Release 1 or later are not affected. |
| Impact | This is a genuine but second-tier priority. The Samsung-issued CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:N) scores 7.0 (HIGH) and indicates a LOCAL attack vector - not network-reachable - which is the single most important mitigating signal: an attacker must already be able to run code or install an app on the device to reach libsamsungtts.so. Impact is asymmetric: VI:H (high integrity, consistent with arbitrary code execution from the out-of-bounds write) but only VC:L confidentiality and VA:L availability. No EPSS score, no CISA KEV listing, and no public POC are present in the supplied data, so there is no evidence of active exploitation or weaponization; the realistic risk is a malicious or compromised local app escalating its foothold rather than mass remote compromise. Note a minor internal tension: the Tags label this 'RCE', but the CVSS AV:L vector means this is LOCAL code execution, not remote - treat 'RCE' loosely. No conflicting attack-vector data otherwise; CWE is unfortunately 'N/A' so the bug class relies on the description ('out-of-bounds write') and the 'Buffer Overflow' tag. |
| Exploit ScenarioDerived | A user installs a malicious or trojanized Android app on a Samsung device; the app invokes the Samsung text-to-speech engine with crafted input that triggers an out-of-bounds write in libsamsungtts.so, letting the attacker execute arbitrary code in the context of the TTS component to escalate privileges or persist. No public exploit code was identified at time of analysis, and because the CVSS vector is AV:L this requires prior local presence on the device rather than remote delivery. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 12, 2026
An out-of-bounds write in the native library libsamsungtts.so, part of the Samsung Text-to-Speech engine shipped on Samsung Android builds, allows code running locally on the device to corrupt memory and achieve arbitrary code execution in the TTS process context. The vulnerable component is reachable without special privileges or user interaction (CVSS 4.0 PR:N/UI:N), but the attack vector is local (AV:L), so the attacker must already have a malicious or compromised app or local process able to invoke the TTS engine and supply crafted input; there is no remote/network exploitation path. Samsung addresses the flaw in the SMR Oct-2026 Release 1 maintenance update, and no public exploit code has been identified at time of analysis.
RemediationAI
Apply the vendor fix by installing Samsung's SMR Oct-2026 Release 1 (or a later security maintenance release) firmware update for the affected device, as published at https://security.samsungmobile.com/securityUpdate.smsb?year=2026&month=10; this is the only authoritative patched version identified in the available data and should be validated against the advisory for each specific model and carrier build. Where immediate patching is not possible, compensating controls must target the local reachability of the TTS engine: (1) reduce the local attack surface by restricting installation to trusted, vetted applications and disabling sideloading / unknown-source installs, since exploitation requires attacker code already running on the device - this does not stop an already-installed malicious app but limits initial placement; (2) if the TTS engine is not required, disable the Samsung TTS service or switch the default text-to-speech engine to an alternative provider in Settings, which removes the reachable code path entirely at the cost of losing Samsung TTS functionality and possibly breaking apps that bind specifically to it; (3) use device management/MDM policy to constrain which apps can bind to or interact with the TTS service and to block untrusted APKs, accepting reduced flexibility for managed fleets. Note there is no network-facing mitigation such as port blocking or reverse-proxy filtering that applies here, because the exploitation vector is strictly local. These workarounds are temporary and should be replaced by the SMR update as soon as it is available for each device.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
libsamsungtts.so is the native shared library implementing Samsung's on-device text-to-speech engine, which parses text and audio/voice-model data passed to it by applications through the Android TTS service interface. The reported flaw is a memory-safety defect in that library - an out-of-bounds write (accepted class: buffer overflow / improper bounds checking on attacker-influenced input) in which the engine writes past the end of an allocated buffer while processing crafted input. Because the bug lives in native code, a successful overwrite can corrupt adjacent heap or stack structures and redirect execution, which is why the Samsung Mobile Security bulletin tags it as remote code execution/buffer overflow despite the local attack vector. Reachability requires a caller on the same device that can drive the TTS engine; the assessed CVSS:3.1 vector AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L reflects low complexity, no privilege or interaction prerequisite, high integrity impact (arbitrary code execution in the TTS process), with limited confidentiality and availability effects. No CWE identifier was supplied in the source data; the defect is best characterized as an out-of-bounds write resulting from missing or insufficient length validation of input before a memory copy/write. No CPE strings were provided, so affected scope must be taken from Samsung's advisory rather than an enumerated CPE list.
Know when Android gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N
Local-only reachable library invoked by an unprivileged app so AV:L/AC:L/PR:N/UI:N; out-of-bounds write yields code execution giving I:H with partial C:L/A:L and no scope change.
Primary rating from Vendor (samsung).
CVSS VectorVendor: samsung
DescriptionCVE.org
Out-of-bounds write in libsamsungtts.so prior to SMR Oct-2026 Release 1 allows local attackers to execute arbitrary code.
Articles & Coverage 2
Executive ViewAI
A high-severity memory corruption flaw in the Samsung Text-to-Speech engine (libsamsungtts.so) affects Samsung Android devices used across our mobile fleet, allowing a malicious or compromised app already on a device to execute code inside the TTS process. Because no vendor patch is currently available and remediation depends on Samsung's SMR Oct-2026 Release 1 maintenance update, the exposure window is defined by how quickly that update reaches our managed devices. Leadership should care because mobile devices carry corporate email, MFA tokens and line-of-business data, and a successful local escalation could be used to access that data or as a foothold for further on-device compromise until the maintenance release is applied.
No vendor-released patch identified at time of analysis. Interim mitigations: enforce MDM application allowlisting and block sideloaded/unknown-source installs to prevent delivery of a malicious local app; restrict or disable the Samsung Text-to-Speech engine on managed devices where business requirements allow; maintain up-to-date mobile threat defense and Google Play Protect; enforce minimum OS security patch levels; and plan rapid deployment of Samsung's SMR Oct-2026 Release 1 maintenance update once available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in A
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly imp
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android bef
Apktool versions 2.9.1 and prior contain a path traversal vulnerability when processing Android APK files. Malicious APK
An elevation of privilege vulnerability in the Android system (art). Rated high severity (CVSS 7.8), this vulnerability
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
Exploit-DB