Samsung Mobile Devices
Monthly
Heap buffer overflow in Samsung KnoxVault trustlet (hwvault trusted application) on Samsung Mobile Devices prior to SMR Sep-2026 Release 1 enables local privileged attackers to execute arbitrary code within the Trusted Execution Environment. The CVSS 4.0 score of 7.1 with AV:L/AC:H/PR:H reflects a high technical bar: exploitation demands pre-existing high-privilege local access plus significant exploit engineering to achieve reliable heap corruption. Samsung confirmed the fix in the September 2026 Monthly Security Release; no public exploit or active exploitation has been identified.
Local privilege escalation to root in Samsung's DualDAR (Dual Data-at-Rest) encryption component affects Samsung mobile devices running Android 14, 15, 16, and 17 prior to the SMR (Samsung Maintenance Release) Sep-2026 Release 1. A use-after-free condition lets a local attacker who already holds elevated privileges execute arbitrary code as root, fully compromising the device. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Improper input validation in Samsung's DualDAR kernel driver enables a local privileged attacker to escalate privileges and execute arbitrary code at root level on affected Samsung Mobile Devices. DualDAR (Dual Data At Rest) is a Samsung Knox encryption subsystem implemented as a kernel-space driver across Android 14 through 17; a flaw in its input handling allows a caller with existing elevated privileges to corrupt driver state and reach kernel execution context. The patch ships in SMR Sep-2026 Release 1. No public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in Samsung Mobile Devices arises from a heap-based buffer overflow in the JPEG decoding path of libimagecodec.quram.so (the proprietary Quram/Qmage image codec) on builds prior to SMR Sep-2026 Release 1. A remote attacker who delivers a maliciously crafted JPEG image to a vulnerable device can corrupt heap memory and execute arbitrary code in the context of the image-processing component. No public exploit was identified at time of analysis, and the CVE is not listed in CISA KEV; Samsung rates it CVSS 4.0 9.2 (critical).
Remote code execution in the DNG (Adobe Digital Negative) image decoder within Samsung's Quram imaging library (libimagecodec.quram.so) affects Samsung mobile devices on Android 14, 15, 16, and 17 prior to the SMR Sep-2026 Release 1 patch. A crafted DNG image parsed by the library triggers a heap-based buffer overflow, letting a remote attacker run arbitrary code in the context of the process handling the image. No public exploit identified at time of analysis, and it is not on the CISA KEV list, but Quram image-parsing flaws have a strong historical track record of weaponization on Samsung/Android.
Path traversal in Samsung's ImsService (IP Multimedia Subsystem Service) on Android 14 through 17 permits remote unauthenticated attackers to create image files at arbitrary filesystem paths under system server privilege. Reported by Samsung Mobile and patched in SMR Sep-2026 Release 1, the flaw is reachable over LTE and Wi-Fi networks with no user interaction required, as reflected in the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) scoring 8.8. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog.
Out-of-bounds write in libmdnie.so on Samsung Mobile Devices running Android 15, 16, and 17 enables local attackers to execute arbitrary code with system server privilege. The flaw resides in Samsung's proprietary Mobile Display Image Enhancement (mdnie) library, which is accessible from low-privilege application contexts with no special Android permissions required. No public exploit has been identified at time of analysis, and Samsung addressed this in the September 2026 Monthly Security Release (SMR Sep-2026 Release 1).
Out-of-bounds write in Samsung's Keymaster trustlet - a Trusted Execution Environment (TEE) component running in ARM TrustZone that handles cryptographic key operations - allows local attackers with high privileges to corrupt memory within the secure world, potentially compromising key material or TEE integrity. Affected devices run Android 14 through 17, with a fix delivered in Samsung's SMR Sep-2026 Release 1. No public exploit code or active exploitation has been identified at time of analysis.
Stack-based buffer overflow in libril_sem.so - Samsung's Radio Interface Layer shared library - enables privileged local attackers to execute arbitrary code on affected Samsung Mobile Devices prior to SMR Aug-2026 Release 1. The CVSS 4.0 vector (AV:L/PR:H) confirms exploitation requires established local access with high privileges, limiting the realistic attacker pool to already-compromised or insider-threat scenarios. No public exploit code or CISA KEV listing has been identified at time of analysis.
Improper access control in the Weaver component of Samsung Mobile devices allows a local attacker without elevated privileges to render the device inoperable, achieving high integrity and availability impact. All Samsung Mobile devices running Weaver prior to the SMR Aug-2026 Release 1 security update are affected. No public exploit code or active exploitation has been confirmed at time of analysis, but the low attack complexity and absence of privilege requirements lower the bar for abuse by a local threat actor.
Memory corruption in Samsung's proprietary ImsService - the IP Multimedia Subsystem component handling VoLTE, Wi-Fi Calling and SIP signaling - can be triggered by a crafted message to produce an out-of-bounds write (CWE-787) and potentially execute arbitrary code on affected Samsung Galaxy devices. Devices running Android 14, 15 or 16 with firmware older than the SMR Jul-2026 Release 1 are exposed; exploitation requires reaching the IMS service stack (per the CVSS 4.0 vector it is unauthenticated with no user interaction, but AT:P indicates a non-attacker-controlled precondition such as an established or negotiable IMS session, a malicious IMS peer, or a position in the carrier signaling path), and confirmed impact is integrity and availability only, with no confidentiality loss. There is no evidence of active exploitation (not in CISA KEV), no public exploit code identified at time of analysis, and EPSS is low at 0.40% (32nd percentile), though the CISA SSVC assessment rates technical impact as total and patch availability (SMR Jul-2026 Release 1) limits the population of vulnerable devices over time.
Local privilege escalation in Samsung Galaxy Watch allows unprivileged local attackers to execute arbitrary code with system-level privileges by exploiting improper input validation in the FacAtFunction component. Affects Galaxy Watch devices running Android Watch 14 and 16 prior to Samsung's May 2026 security release (SMR May-2026 Release 1). EPSS score of 0.03% indicates low automated exploitation probability, and no active exploitation or public POC has been identified at time of analysis. Attack requires physical or ADB access to the device.
Google's Secure Folder prior to the March 2026 SMR release improperly exports Android application components, enabling local attackers to execute arbitrary activities with Secure Folder privileges. This high-severity vulnerability affects users with local device access and could allow privilege escalation or unauthorized access to protected data. No patch is currently available.
Improper access control in Samsung's ManagedProvisioning system component allows a locally present application to install arbitrary packages on affected Galaxy devices running firmware older than the September 2026 Security Maintenance Release (SMR Sep-2026 Release 1). Exploitation requires an attacker-controlled app already executing on the device (AV:L) but demands no additional privileges (PR:N) and no user interaction (UI:N), so a malicious or sideloaded app can drive a privileged provisioning path to install software the user never authorized. No confirmed actively exploited (CISA KEV) status and no publicly available exploit code identified at time of analysis, and the independent reassessment (CVSS 3.1 6.9, C:N/I:H/A:N) frames this as a moderate, locally scoped integrity risk rather than an urgent, remotely reachable one.
Path traversal in Samsung's GalaxyDiagnostics component on Samsung Mobile Devices allows a physical attacker to access files with system-level privilege, affecting Android versions 14 through 17 prior to the SMR Sep-2026 Release 1 patch. The CVSS 4.0 vector (AV:P/VC:H/VI:H) confirms both high confidentiality and integrity impact but constrains exploitation to physical presence at the device. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Improper access control in Samsung SystemUI prior to SMR Sep-2026 Release 1 permits any locally-executing attacker without elevated privileges to launch arbitrary Android activities on affected devices. Samsung Mobile Devices running Android 14 through 17 are affected, with the fix delivered in the September 2026 Monthly Security Release. No public exploit code or active exploitation has been identified at time of analysis.
Improper access control in Samsung's SettingsProvider component on Android allows local attackers to read sensitive device settings without holding any special permissions. Affected devices run Android 15, 16, or 17 with Samsung firmware prior to the SMR Sep-2026 Release 1 patch bundle. No public exploit has been identified at time of analysis, and the CVSS 4.0 score of 5.1 with VC:L reflects the limited (though real) confidentiality exposure from a purely local attack surface.
Improper access control in Samsung's Link to Windows Android application allows a local attacker to establish an unauthorized connection with a paired Windows PC, silently bypassing the user-consent step required for pairing. Affected Samsung Mobile Devices run Android 14 through 17 with the Link to Windows app prior to SMR Sep-2026 Release 1. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; the local attack vector substantially constrains real-world exposure to physical or on-device access scenarios.
Improper authentication in Samsung's ActivityTaskManagerService allows local privileged attackers on affected Android devices to launch arbitrary activities, bypassing intended access controls. The flaw affects Samsung Mobile Devices running Android 14 through 17 and is addressed in the SMR Sep-2026 Release 1 patch. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS 4.0 score of 4.6 reflects the constrained local-privileged attack surface.
Out-of-bounds memory write in wpa_supplicant on Samsung Mobile Devices (Android 14 through 17) enables an adjacent unauthenticated attacker to corrupt process memory, with the CVSS 4.0 vector confirming potential high-confidentiality impact - likely exposure of Wi-Fi credentials or session keying material held in the wpa_supplicant process. Samsung resolved this in the SMR Sep-2026 Release 1 patch for all four affected Android generations. No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Stack-based buffer overflow in Samsung's PROCA (Process Authenticator) TrustZone trustlet allows a local privileged attacker to write out-of-bounds memory, resulting in high-confidentiality impact against affected Samsung Mobile Devices running Android 14 through 17. The flaw is patched in SMR Sep-2026 Release 1. No public exploit code or active exploitation has been identified; the CVSS 4.0 score of 5.6 reflects the significant exploitation barriers - local access, high privileges, high complexity, and specific prerequisite conditions all required simultaneously.
Out-of-bounds write in Samsung's libcodec2secevrcdec.so codec library exposes Samsung Mobile Devices running Android 14 through 17 to local memory corruption by low-privileged attackers. The flaw resides in a proprietary secure EVR codec decoder and was addressed in Samsung's SMR Sep-2026 Release 1. No public exploit code or active exploitation has been identified at time of analysis.
Out-of-bounds write in the Samsung-proprietary libsaviextractor.so library allows a local low-privileged attacker to corrupt memory on affected Samsung devices running Android 14 through 17. Exploitation requires code execution on the device with at minimum a standard user account, limiting the attack surface to malicious apps or post-compromise scenarios. Samsung has addressed the issue in SMR Sep-2026 Release 1; no public exploit or active exploitation has been identified at time of analysis.
Out-of-bounds memory write in Samsung's libsubextractor.so subtitle processing library allows local attackers to corrupt memory by exploiting improper input validation when removing style tags from subtitle content. Affected devices run Android 14 through 17 and are fixed in SMR Sep-2026 Release 1, disclosed through Samsung's monthly security bulletin. No public exploit identified at time of analysis, though the integrity impact is rated high (VI:H in CVSS 4.0), suggesting realistic potential for privilege escalation or code execution if chained with further exploitation.
Out-of-bounds memory write in Samsung's libsubextractor.so subtitle parsing library affects Samsung Mobile Devices running Android 14 through 17, exploitable by a local attacker who induces the device owner to open or play media containing a maliciously crafted subtitle track. The flaw carries a high integrity impact rating consistent with a memory-corruption primitive capable of enabling code execution within the media processing context, patched in the SMR Sep-2026 Release 1 monthly security update. No public exploit code or active exploitation has been identified at time of analysis.
Improper authorization in the ProxyHandler component of Samsung Android devices allows a locally-executing, low-privileged attacker to read proxy configuration without proper access controls. Devices running Android 14 through 17 are affected and patched in the SMR September 2026 release cycle. No public exploit code exists and no active exploitation has been identified; the CVSS 4.0 score of 4.8 accurately reflects the constrained local-only attack surface.
Improper input validation in the Galaxy Themes application on Samsung Mobile Devices allows a physical attacker to launch arbitrary Android activities, with a high confidentiality impact on the vulnerable system. Affected devices are those running Galaxy Themes prior to the SMR Aug-2026 Release 1 security update. The vulnerability is tagged as an information disclosure issue, and while it requires physical device access and active user interaction, exploitation could allow access to sensitive device data or protected application screens that would otherwise be restricted. No public exploit has been identified at time of analysis, and no KEV listing exists.
Out-of-bounds memory write in the VC1 codec implementation within libsavsvc.so on Samsung Mobile Devices exposes affected handsets to local memory corruption with limited but confirmed multi-property impact. Devices running Samsung firmware prior to SMR Aug-2026 Release 1 are vulnerable, with the flaw addressable by updating to the August 2026 Samsung Monthly Release. No public exploit code has been identified and the vulnerability is absent from CISA KEV, indicating no confirmed active exploitation at time of analysis.
Out-of-bounds memory write in Samsung Mobile Devices' MPEG4 codec library libsavsvc.so enables local attackers with no special privileges to corrupt memory, potentially leading to code execution or service disruption across affected system components. All Samsung Mobile Devices running firmware prior to SMR Aug-2026 Release 1 are exposed via this improper input validation flaw in the proprietary media codec. No public exploit code has been identified at time of analysis, but the low attack complexity and absence of privilege requirements lower the bar for exploitation on any affected device with an unprivileged app installed.
Samsung Message on Android devices prior to SMR Aug-2026 Release 1 exposes sensitive user information to physical attackers through improper input validation. An attacker with physical access to an unlocked or accessible device can interact with the Samsung Message application to trigger the flaw and read confidential message content or related data. No public exploit code has been identified, and exploitation requires hands-on device access, limiting widespread automated abuse.
Out-of-bounds memory write in Samsung's VC1 codec library libsavsvc.so allows local attackers to corrupt process memory on affected Samsung mobile devices. The root cause is an incorrect numeric type conversion during VC1 video decoding, a class of error that can produce exploitable integer truncation or overflow conditions leading to heap or stack corruption. No public exploit code has been identified at time of analysis, and the vendor has addressed this in the SMR Aug-2026 Release 1 security update.
Out-of-bounds memory write in libsmsd.so affects all Samsung Mobile Devices running firmware prior to SMR Aug-2026 Release 1, exploitable by a local unprivileged attacker with no special privileges required. The flaw in Samsung's SMS daemon shared library allows memory corruption that could destabilize the smsd process or, with additional technique, enable code execution within the daemon's privilege context. No public exploit identified at time of analysis, and no CISA KEV listing; however, low attack complexity combined with zero privilege requirements makes this actionable for any malicious app or shell-level actor on an unpatched device.
Out-of-bounds memory write in Samsung's libcodec2_sec_flacdec.so FLAC decoder library exposes Samsung Mobile Devices to local exploitation on firmware prior to the SMR Aug-2026 Release 1 patch. The root cause is improper input validation in the secure FLAC decoding component, allowing a local attacker to write beyond allocated memory boundaries and potentially corrupt adjacent memory. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists for this CVE.
Out-of-bounds write in Samsung's libcodec2secqcelpdec.so QCELP audio codec decoder library allows local attackers holding low-privilege execution on affected Samsung devices to corrupt adjacent memory regions, with limited confidentiality, integrity, and availability impact confined to the vulnerable system. The flaw is addressed in SMR Aug-2026 Release 1, Samsung's August 2026 Security Maintenance Release covering all prior unpatched firmware builds. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS 4.0 score of 4.4 reflects the strictly local attack surface and bounded impact scope.
AppLock on Samsung Mobile Devices prior to SMR Aug-2026 Release 1 exposes improperly exported Android application components, enabling a physical attacker to bypass the app lock protection layer entirely. The flaw grants access to confidentiality- and integrity-sensitive data within locked applications without satisfying the intended authentication challenge. No public exploit is identified at time of analysis; exploitation is constrained to physical device access, limiting but not eliminating real-world risk for lost or stolen device scenarios.
SemClipboardService on Samsung Mobile Devices prior to SMR Aug-2026 Release 1 exposes an authorization bypass that allows a locally authenticated attacker to read clipboard contents without the expected permission check. The flaw is confined to Samsung's proprietary clipboard service and does not affect stock Android builds. No public exploit has been identified at time of analysis, and no active exploitation is listed in CISA KEV.
Samsung Dialer on Samsung Mobile Devices prior to SMR Aug-2026 Release 1 exposes SIM-related functions to remote attackers through improper input validation, requiring user interaction to trigger. The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:P/VC:H) classifies this as a network-reachable, high-confidentiality-impact flaw, though high attack complexity and specific prerequisites substantially reduce the realistic threat surface. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Samsung Contacts on Samsung Mobile Devices prior to SMR Aug-2026 Release 1 exposes contact data across Android user profiles to an attacker with physical device access, due to improper input validation that fails to enforce inter-profile data isolation. The CVSS 4.0 vector confirms both the physical access prerequisite (AV:P) and the scope extension to a secondary user's data (SC:H), consistent with a profile boundary bypass in a multi-user Android environment. No public exploit code or active exploitation has been identified at time of analysis.
Unauthorized file deletion via improperly exported Android components in Samsung Contacts prior to SMR Aug-2026 Release 1 allows any locally-installed malicious application to invoke the exported component and delete files under Samsung Contacts' privilege without requiring any elevated permissions of its own. The vulnerability stems from an Android component export misconfiguration, granting third-party apps unintended access to privileged file operations. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and absence of privilege requirements make this straightforward to exploit on affected devices.
Improper input validation in Samsung Contacts on Samsung Mobile devices prior to SMR Aug-2026 Release 1 enables local attackers to delete files under Samsung Contacts' process privilege, bypassing the Android sandbox boundary between applications. The CVSS 4.0 score of 6.9 with VI:H reflects high integrity impact on the vulnerable system, though the local attack vector constrains opportunistic exploitation. No public exploit code exists and the vulnerability is not listed in CISA KEV at time of analysis; Samsung has released a fix in the August 2026 Security Maintenance Release.
Improper authorization in Samsung's AppBlock application on Android 15 and 16 devices allows a local, low-privileged attacker to launch arbitrary Android Activities without proper permission checks. Exploitation requires passive user interaction (CVSS 4.0 UI:P) and local device access, but the confidentiality impact on the vulnerable system is rated High (VC:H), consistent with the reported Information Disclosure tag. No public exploit code exists and the vulnerability is not listed in CISA's KEV catalog at time of analysis; Samsung has released a patch in SMR Jun-2026 Release 1.
Improper access control in the MediaTek Audio HAL on Samsung Mobile Devices running Android 14, 15, and 16 permits local unprivileged attackers to invoke restricted privileged functions within the audio subsystem. The CVSS 4.0 subsequent system impact is rated High across confidentiality, integrity, and availability (SC:H/SI:H/SA:H), indicating that successful exploitation can cascade well beyond the Audio HAL itself to compromise broader device system components. No public exploit identified at time of analysis; Samsung has released a fix in SMR Jun-2026 Release 1.
Improper Android component export in Samsung's Galaxy Editing Service exposes privileged operations to local, low-privileged attackers on Android 14, 15, and 16 devices prior to SMR Jun-2026 Release 1. A malicious app installed on the device can directly invoke these exported components - bypassing intended permission controls - to execute operations with elevated privileges, resulting in high integrity impact on the vulnerable system. No public exploit identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog.
Improper access control in the AuditLogService component of Samsung Mobile Devices running Android 16 exposes sensitive audit log information to local attackers. The flaw, disclosed and patched by Samsung Mobile as part of their June 2026 Security Maintenance Release (SMR Jun-2026 Release 1), enables a local attacker without special privileges to both read and potentially modify sensitive data surfaced by the audit logging subsystem. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
ImsSettings on Samsung Mobile Devices (Android 14, 15, 16) exposes an improperly exported Android application component, enabling locally authenticated low-privilege attackers to invoke the component and trigger its logging function, resulting in limited information disclosure. The vulnerability is patched in Samsung's SMR Jun-2026 Release 1 and is reported exclusively by Samsung Mobile. No public exploit code and no CISA KEV listing have been identified at time of analysis, and the CVSS 4.0 score of 4.8 (Medium) reflects the narrow, local-only impact.
Improper export of Android application components in Samsung's SpriteWallpaper app enables local attackers without privileges to access sensitive information and achieve disproportionately high impact on subsequent system components. Devices running Android 16 prior to the SMR Jun-2026 Release 1 security update are affected. No public exploit has been identified at time of analysis, but the zero-privilege local requirement and high subsequent system impact (SC:H/SI:H/SA:H) elevate practical risk on shared or managed Android devices.
Incorrect privilege assignment in the Telephony component of Samsung Mobile devices prior to SMR Jun-2026 Release 1 permits local attackers to access sensitive information without requiring prior privileges or user interaction. Affecting devices running Android 14, 15, and 16, the flaw stems from improper access controls within the telephony subsystem. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog, but the low attack complexity and absence of privilege prerequisites lower the bar for local exploitation.
Improper privilege handling in Samsung's SecTelephonyProvider component allows local attackers on Samsung Mobile Devices to access files that should be restricted to privileged processes. Affected devices run Android 14, 15, and 16 prior to the SMR Jun-2026 Release 1 patch, spanning the full current Samsung Android support matrix. No public exploit code exists and no KEV listing has been issued; the CVSS 4.0 score of 4.6 reflects constrained real-world impact due to required local access and active user interaction.
Improper permission handling in the Routines automation feature on Samsung Mobile Devices exposes sensitive information to local attackers without requiring elevated privileges. Affected devices run Samsung One UI on Android 15 and Android 16, prior to the SMR May-2026 Release 1 security update. No public exploit has been identified at time of analysis, and CISA's SSVC framework classifies current exploitation as none, consistent with an EPSS score at the 3rd percentile.
Improper input validation in the Routines feature on Samsung Mobile Devices (Android 16) enables a physical attacker to launch privileged activities outside normal authorization boundaries. Affected devices are those running any build prior to SMR May-2026 Release 1, as confirmed by Samsung Mobile Security. No public exploit exists at time of analysis, and EPSS at 0.04% (13th percentile) reflects the negligible likelihood of widespread exploitation given the mandatory physical access requirement.
OmaCP on Samsung Android devices (Android 14, 15, and 16) exposes improperly exported application components that allow any co-resident local application to invoke privileged functions without holding the required permissions. The flaw is rooted in Android's IPC mechanism, where components lacking proper access control declarations can be targeted by crafted intents from other installed apps. No public exploit code has been identified at the time of analysis, and EPSS sits at 0.01% (3rd percentile), consistent with SSVC's exploitation status of none; risk is real but bounded by the local attack vector.
Out-of-bounds memory write in Samsung's SveService component allows local attackers holding high privileges to execute arbitrary code on affected devices. Impacting Samsung Mobile Devices running Android 14, 15, and 16 prior to SMR May-2026 Release 1, exploitation is constrained to local privileged actors, substantially limiting real-world attack surface. No public exploit code exists and no confirmed active exploitation has been reported; EPSS places this at the 3rd percentile (0.01%), consistent with the elevated barrier to entry.
Incorrect privilege assignment in the LocationManager component of Samsung Mobile Devices (Android 14, 15, and 16) enables local attackers to access sensitive information without holding the requisite Android permissions. The flaw is addressed in Samsung's SMR May-2026 Release 1 security update. No public exploit code exists, EPSS stands at the 3rd percentile, and CISA has not listed this in the KEV catalog, placing it in a low-urgency category despite the broad Samsung device footprint.
FactoryCamera on Samsung Mobile Devices prior to SMR May-2026 Release 1 exposes a unique device identifier to local low-privileged attackers due to incorrect default file or resource permissions (CWE-276). Affected platforms span Android 14, 15, and 16. The vulnerability carries a CVSS 4.0 score of 6.8 with high confidentiality impact on the vulnerable system, though real-world risk is substantially tempered by the requirement for local device access, an EPSS of 0.01% (1st percentile), and SSVC classification of exploitation: none. No public exploit code or active exploitation has been identified at time of analysis.
PackageManagerService on Samsung Mobile Devices running Android 14, 15, and 16 allows local attackers without elevated privileges to bypass application installation restrictions by exploiting insufficient verification of data authenticity. The affected component fails to adequately validate the integrity of data governing app installation policies, enabling unauthorized modification of those restrictions on unpatched devices. No public exploit code has been identified and SSVC rates exploitation as none, but the impact is significant in enterprise MDM and parental-control deployments where installation restrictions are an active security control.
Improper input validation in Samsung Mobile Retail Mode prior to SMR April 2026 Release 1 allows local attackers with limited privileges to trigger privileged functions, potentially leading to information disclosure and unauthorized modification of device state. The vulnerability requires physical or local access and low-privilege credentials, limiting immediate remote exploitation risk but posing significant concern for retail environments where devices are physically accessible to untrusted parties.
Samsung Mobile S Share application prior to the April 2026 SMR Release 1 exposes sensitive information to adjacent network attackers without requiring authentication, achieved through a low-complexity attack requiring only user interaction. The vulnerability has a CVSS 5.1 score reflecting limited confidentiality impact over an adjacent network, and is addressed in the April 2026 security patch release.
External control of file name in Samsung AODManager prior to April 2026 SMR Release 1 allows privileged local attackers to create files with system privileges, potentially leading to privilege escalation or system compromise. The vulnerability requires high-level local privileges and affects Samsung Mobile devices through a path traversal or file name manipulation flaw in the AODManager component. No public exploit code has been identified at the time of analysis.
Bluetooth maintenance mode in Samsung Mobile devices prior to April 2026 SMR Release 1 permits physical attackers to bypass Extend Unlock authentication due to incorrect privilege assignment, enabling unauthorized device access without requiring prior authentication. The vulnerability requires physical proximity and user interaction but grants full confidentiality and integrity compromise of the device. No public exploit code has been identified at the time of analysis.
Samsung Mobile's Recents application prior to SMR Apr-2026 Release 1 fails to properly validate exceptional conditions, allowing a physical attacker to bypass App Pinning security controls. The vulnerability requires physical device access and has a CVSS score of 4.1 reflecting the physical attack vector and confidentiality impact; no public exploit code or confirmed active exploitation has been identified.
Device Care in Samsung Mobile devices prior to the April 2026 SMR Release 1 contains an improper exception handling vulnerability that permits physical attackers to bypass Knox Guard authentication enforcement. With a CVSS score of 4.4 and attack vector requiring physical access, this vulnerability poses a localized but serious integrity and confidentiality risk to device security architecture, particularly for devices left unattended or in corporate environments where physical access controls may be compromised.
Samsung DeX prior to the April 2026 Release 1 update contains improper access control that allows physical attackers to access hidden notification contents on affected Samsung mobile devices. The vulnerability requires direct physical access to the device but carries high scope and information integrity impact due to potential exposure of sensitive notification data. No public exploit code has been identified at the time of analysis.
Improper input validation in Samsung Mobile devices prior to SMR April 2026 Release 1 allows physical attackers to bypass network restrictions without authentication. The vulnerability affects data handling related to network restriction policies, enabling unauthorized modification of network access controls. CVSS score of 5.2 reflects the physical attack requirement, though integrity and availability impacts are rated high for affected functions.
An improper authorization vulnerability in Samsung Settings allows a local attacker with low privileges to disable configuration of background data usage for applications prior to the SMR Mar-2026 Release 1 patch. While the CVSS score of 4.8 is moderate, the vulnerability has limited impact as it only affects the integrity of data usage settings without enabling data exfiltration or system compromise. The local attack vector and requirement for user-level privileges significantly reduce real-world exploitation likelihood compared to remote or privilege-escalation vulnerabilities.
ThemeManager prior to the SMR Mar-2026 Release 1 contains an improper privilege management vulnerability that allows local privileged attackers to inappropriately reuse trial contents, potentially circumventing licensing restrictions or trial period limitations. With a CVSS score of 6.7 and requiring high privileges (PR:H) but no user interaction, this vulnerability poses a moderate integrity risk in environments where multiple privileged users share access to ThemeManager systems. No public proof-of-concept or active exploitation has been reported in the CVE record, and this does not appear on CISA's KEV catalog, suggesting limited real-world weaponization at present.
This vulnerability involves improper cryptographic signature verification in the Font Settings component of Samsung devices prior to the March 2026 Security Update Release 1. A physical attacker can bypass signature validation to install custom fonts, potentially leading to integrity compromise of system font resources. While the CVSS score is moderate at 5.1, the attack requires physical access and user interaction, limiting real-world exploitation frequency.
A broadcast receiver in Android Settings fails to properly verify intents prior to the March 2026 Security Maintenance Release 1, allowing a local attacker with limited privileges to launch arbitrary activities with Settings-level permissions. The vulnerability requires user interaction to trigger and carries a CVSS 4.0 score of 6.8, reflecting high confidentiality and integrity impact. No public exploit or KEV designation is currently documented, but the local attack vector and privilege escalation potential warrant prompt patching.
Heap buffer overflow in Samsung KnoxVault trustlet (hwvault trusted application) on Samsung Mobile Devices prior to SMR Sep-2026 Release 1 enables local privileged attackers to execute arbitrary code within the Trusted Execution Environment. The CVSS 4.0 score of 7.1 with AV:L/AC:H/PR:H reflects a high technical bar: exploitation demands pre-existing high-privilege local access plus significant exploit engineering to achieve reliable heap corruption. Samsung confirmed the fix in the September 2026 Monthly Security Release; no public exploit or active exploitation has been identified.
Local privilege escalation to root in Samsung's DualDAR (Dual Data-at-Rest) encryption component affects Samsung mobile devices running Android 14, 15, 16, and 17 prior to the SMR (Samsung Maintenance Release) Sep-2026 Release 1. A use-after-free condition lets a local attacker who already holds elevated privileges execute arbitrary code as root, fully compromising the device. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Improper input validation in Samsung's DualDAR kernel driver enables a local privileged attacker to escalate privileges and execute arbitrary code at root level on affected Samsung Mobile Devices. DualDAR (Dual Data At Rest) is a Samsung Knox encryption subsystem implemented as a kernel-space driver across Android 14 through 17; a flaw in its input handling allows a caller with existing elevated privileges to corrupt driver state and reach kernel execution context. The patch ships in SMR Sep-2026 Release 1. No public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in Samsung Mobile Devices arises from a heap-based buffer overflow in the JPEG decoding path of libimagecodec.quram.so (the proprietary Quram/Qmage image codec) on builds prior to SMR Sep-2026 Release 1. A remote attacker who delivers a maliciously crafted JPEG image to a vulnerable device can corrupt heap memory and execute arbitrary code in the context of the image-processing component. No public exploit was identified at time of analysis, and the CVE is not listed in CISA KEV; Samsung rates it CVSS 4.0 9.2 (critical).
Remote code execution in the DNG (Adobe Digital Negative) image decoder within Samsung's Quram imaging library (libimagecodec.quram.so) affects Samsung mobile devices on Android 14, 15, 16, and 17 prior to the SMR Sep-2026 Release 1 patch. A crafted DNG image parsed by the library triggers a heap-based buffer overflow, letting a remote attacker run arbitrary code in the context of the process handling the image. No public exploit identified at time of analysis, and it is not on the CISA KEV list, but Quram image-parsing flaws have a strong historical track record of weaponization on Samsung/Android.
Path traversal in Samsung's ImsService (IP Multimedia Subsystem Service) on Android 14 through 17 permits remote unauthenticated attackers to create image files at arbitrary filesystem paths under system server privilege. Reported by Samsung Mobile and patched in SMR Sep-2026 Release 1, the flaw is reachable over LTE and Wi-Fi networks with no user interaction required, as reflected in the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) scoring 8.8. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog.
Out-of-bounds write in libmdnie.so on Samsung Mobile Devices running Android 15, 16, and 17 enables local attackers to execute arbitrary code with system server privilege. The flaw resides in Samsung's proprietary Mobile Display Image Enhancement (mdnie) library, which is accessible from low-privilege application contexts with no special Android permissions required. No public exploit has been identified at time of analysis, and Samsung addressed this in the September 2026 Monthly Security Release (SMR Sep-2026 Release 1).
Out-of-bounds write in Samsung's Keymaster trustlet - a Trusted Execution Environment (TEE) component running in ARM TrustZone that handles cryptographic key operations - allows local attackers with high privileges to corrupt memory within the secure world, potentially compromising key material or TEE integrity. Affected devices run Android 14 through 17, with a fix delivered in Samsung's SMR Sep-2026 Release 1. No public exploit code or active exploitation has been identified at time of analysis.
Stack-based buffer overflow in libril_sem.so - Samsung's Radio Interface Layer shared library - enables privileged local attackers to execute arbitrary code on affected Samsung Mobile Devices prior to SMR Aug-2026 Release 1. The CVSS 4.0 vector (AV:L/PR:H) confirms exploitation requires established local access with high privileges, limiting the realistic attacker pool to already-compromised or insider-threat scenarios. No public exploit code or CISA KEV listing has been identified at time of analysis.
Improper access control in the Weaver component of Samsung Mobile devices allows a local attacker without elevated privileges to render the device inoperable, achieving high integrity and availability impact. All Samsung Mobile devices running Weaver prior to the SMR Aug-2026 Release 1 security update are affected. No public exploit code or active exploitation has been confirmed at time of analysis, but the low attack complexity and absence of privilege requirements lower the bar for abuse by a local threat actor.
Memory corruption in Samsung's proprietary ImsService - the IP Multimedia Subsystem component handling VoLTE, Wi-Fi Calling and SIP signaling - can be triggered by a crafted message to produce an out-of-bounds write (CWE-787) and potentially execute arbitrary code on affected Samsung Galaxy devices. Devices running Android 14, 15 or 16 with firmware older than the SMR Jul-2026 Release 1 are exposed; exploitation requires reaching the IMS service stack (per the CVSS 4.0 vector it is unauthenticated with no user interaction, but AT:P indicates a non-attacker-controlled precondition such as an established or negotiable IMS session, a malicious IMS peer, or a position in the carrier signaling path), and confirmed impact is integrity and availability only, with no confidentiality loss. There is no evidence of active exploitation (not in CISA KEV), no public exploit code identified at time of analysis, and EPSS is low at 0.40% (32nd percentile), though the CISA SSVC assessment rates technical impact as total and patch availability (SMR Jul-2026 Release 1) limits the population of vulnerable devices over time.
Local privilege escalation in Samsung Galaxy Watch allows unprivileged local attackers to execute arbitrary code with system-level privileges by exploiting improper input validation in the FacAtFunction component. Affects Galaxy Watch devices running Android Watch 14 and 16 prior to Samsung's May 2026 security release (SMR May-2026 Release 1). EPSS score of 0.03% indicates low automated exploitation probability, and no active exploitation or public POC has been identified at time of analysis. Attack requires physical or ADB access to the device.
Google's Secure Folder prior to the March 2026 SMR release improperly exports Android application components, enabling local attackers to execute arbitrary activities with Secure Folder privileges. This high-severity vulnerability affects users with local device access and could allow privilege escalation or unauthorized access to protected data. No patch is currently available.
Improper access control in Samsung's ManagedProvisioning system component allows a locally present application to install arbitrary packages on affected Galaxy devices running firmware older than the September 2026 Security Maintenance Release (SMR Sep-2026 Release 1). Exploitation requires an attacker-controlled app already executing on the device (AV:L) but demands no additional privileges (PR:N) and no user interaction (UI:N), so a malicious or sideloaded app can drive a privileged provisioning path to install software the user never authorized. No confirmed actively exploited (CISA KEV) status and no publicly available exploit code identified at time of analysis, and the independent reassessment (CVSS 3.1 6.9, C:N/I:H/A:N) frames this as a moderate, locally scoped integrity risk rather than an urgent, remotely reachable one.
Path traversal in Samsung's GalaxyDiagnostics component on Samsung Mobile Devices allows a physical attacker to access files with system-level privilege, affecting Android versions 14 through 17 prior to the SMR Sep-2026 Release 1 patch. The CVSS 4.0 vector (AV:P/VC:H/VI:H) confirms both high confidentiality and integrity impact but constrains exploitation to physical presence at the device. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Improper access control in Samsung SystemUI prior to SMR Sep-2026 Release 1 permits any locally-executing attacker without elevated privileges to launch arbitrary Android activities on affected devices. Samsung Mobile Devices running Android 14 through 17 are affected, with the fix delivered in the September 2026 Monthly Security Release. No public exploit code or active exploitation has been identified at time of analysis.
Improper access control in Samsung's SettingsProvider component on Android allows local attackers to read sensitive device settings without holding any special permissions. Affected devices run Android 15, 16, or 17 with Samsung firmware prior to the SMR Sep-2026 Release 1 patch bundle. No public exploit has been identified at time of analysis, and the CVSS 4.0 score of 5.1 with VC:L reflects the limited (though real) confidentiality exposure from a purely local attack surface.
Improper access control in Samsung's Link to Windows Android application allows a local attacker to establish an unauthorized connection with a paired Windows PC, silently bypassing the user-consent step required for pairing. Affected Samsung Mobile Devices run Android 14 through 17 with the Link to Windows app prior to SMR Sep-2026 Release 1. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; the local attack vector substantially constrains real-world exposure to physical or on-device access scenarios.
Improper authentication in Samsung's ActivityTaskManagerService allows local privileged attackers on affected Android devices to launch arbitrary activities, bypassing intended access controls. The flaw affects Samsung Mobile Devices running Android 14 through 17 and is addressed in the SMR Sep-2026 Release 1 patch. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS 4.0 score of 4.6 reflects the constrained local-privileged attack surface.
Out-of-bounds memory write in wpa_supplicant on Samsung Mobile Devices (Android 14 through 17) enables an adjacent unauthenticated attacker to corrupt process memory, with the CVSS 4.0 vector confirming potential high-confidentiality impact - likely exposure of Wi-Fi credentials or session keying material held in the wpa_supplicant process. Samsung resolved this in the SMR Sep-2026 Release 1 patch for all four affected Android generations. No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Stack-based buffer overflow in Samsung's PROCA (Process Authenticator) TrustZone trustlet allows a local privileged attacker to write out-of-bounds memory, resulting in high-confidentiality impact against affected Samsung Mobile Devices running Android 14 through 17. The flaw is patched in SMR Sep-2026 Release 1. No public exploit code or active exploitation has been identified; the CVSS 4.0 score of 5.6 reflects the significant exploitation barriers - local access, high privileges, high complexity, and specific prerequisite conditions all required simultaneously.
Out-of-bounds write in Samsung's libcodec2secevrcdec.so codec library exposes Samsung Mobile Devices running Android 14 through 17 to local memory corruption by low-privileged attackers. The flaw resides in a proprietary secure EVR codec decoder and was addressed in Samsung's SMR Sep-2026 Release 1. No public exploit code or active exploitation has been identified at time of analysis.
Out-of-bounds write in the Samsung-proprietary libsaviextractor.so library allows a local low-privileged attacker to corrupt memory on affected Samsung devices running Android 14 through 17. Exploitation requires code execution on the device with at minimum a standard user account, limiting the attack surface to malicious apps or post-compromise scenarios. Samsung has addressed the issue in SMR Sep-2026 Release 1; no public exploit or active exploitation has been identified at time of analysis.
Out-of-bounds memory write in Samsung's libsubextractor.so subtitle processing library allows local attackers to corrupt memory by exploiting improper input validation when removing style tags from subtitle content. Affected devices run Android 14 through 17 and are fixed in SMR Sep-2026 Release 1, disclosed through Samsung's monthly security bulletin. No public exploit identified at time of analysis, though the integrity impact is rated high (VI:H in CVSS 4.0), suggesting realistic potential for privilege escalation or code execution if chained with further exploitation.
Out-of-bounds memory write in Samsung's libsubextractor.so subtitle parsing library affects Samsung Mobile Devices running Android 14 through 17, exploitable by a local attacker who induces the device owner to open or play media containing a maliciously crafted subtitle track. The flaw carries a high integrity impact rating consistent with a memory-corruption primitive capable of enabling code execution within the media processing context, patched in the SMR Sep-2026 Release 1 monthly security update. No public exploit code or active exploitation has been identified at time of analysis.
Improper authorization in the ProxyHandler component of Samsung Android devices allows a locally-executing, low-privileged attacker to read proxy configuration without proper access controls. Devices running Android 14 through 17 are affected and patched in the SMR September 2026 release cycle. No public exploit code exists and no active exploitation has been identified; the CVSS 4.0 score of 4.8 accurately reflects the constrained local-only attack surface.
Improper input validation in the Galaxy Themes application on Samsung Mobile Devices allows a physical attacker to launch arbitrary Android activities, with a high confidentiality impact on the vulnerable system. Affected devices are those running Galaxy Themes prior to the SMR Aug-2026 Release 1 security update. The vulnerability is tagged as an information disclosure issue, and while it requires physical device access and active user interaction, exploitation could allow access to sensitive device data or protected application screens that would otherwise be restricted. No public exploit has been identified at time of analysis, and no KEV listing exists.
Out-of-bounds memory write in the VC1 codec implementation within libsavsvc.so on Samsung Mobile Devices exposes affected handsets to local memory corruption with limited but confirmed multi-property impact. Devices running Samsung firmware prior to SMR Aug-2026 Release 1 are vulnerable, with the flaw addressable by updating to the August 2026 Samsung Monthly Release. No public exploit code has been identified and the vulnerability is absent from CISA KEV, indicating no confirmed active exploitation at time of analysis.
Out-of-bounds memory write in Samsung Mobile Devices' MPEG4 codec library libsavsvc.so enables local attackers with no special privileges to corrupt memory, potentially leading to code execution or service disruption across affected system components. All Samsung Mobile Devices running firmware prior to SMR Aug-2026 Release 1 are exposed via this improper input validation flaw in the proprietary media codec. No public exploit code has been identified at time of analysis, but the low attack complexity and absence of privilege requirements lower the bar for exploitation on any affected device with an unprivileged app installed.
Samsung Message on Android devices prior to SMR Aug-2026 Release 1 exposes sensitive user information to physical attackers through improper input validation. An attacker with physical access to an unlocked or accessible device can interact with the Samsung Message application to trigger the flaw and read confidential message content or related data. No public exploit code has been identified, and exploitation requires hands-on device access, limiting widespread automated abuse.
Out-of-bounds memory write in Samsung's VC1 codec library libsavsvc.so allows local attackers to corrupt process memory on affected Samsung mobile devices. The root cause is an incorrect numeric type conversion during VC1 video decoding, a class of error that can produce exploitable integer truncation or overflow conditions leading to heap or stack corruption. No public exploit code has been identified at time of analysis, and the vendor has addressed this in the SMR Aug-2026 Release 1 security update.
Out-of-bounds memory write in libsmsd.so affects all Samsung Mobile Devices running firmware prior to SMR Aug-2026 Release 1, exploitable by a local unprivileged attacker with no special privileges required. The flaw in Samsung's SMS daemon shared library allows memory corruption that could destabilize the smsd process or, with additional technique, enable code execution within the daemon's privilege context. No public exploit identified at time of analysis, and no CISA KEV listing; however, low attack complexity combined with zero privilege requirements makes this actionable for any malicious app or shell-level actor on an unpatched device.
Out-of-bounds memory write in Samsung's libcodec2_sec_flacdec.so FLAC decoder library exposes Samsung Mobile Devices to local exploitation on firmware prior to the SMR Aug-2026 Release 1 patch. The root cause is improper input validation in the secure FLAC decoding component, allowing a local attacker to write beyond allocated memory boundaries and potentially corrupt adjacent memory. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists for this CVE.
Out-of-bounds write in Samsung's libcodec2secqcelpdec.so QCELP audio codec decoder library allows local attackers holding low-privilege execution on affected Samsung devices to corrupt adjacent memory regions, with limited confidentiality, integrity, and availability impact confined to the vulnerable system. The flaw is addressed in SMR Aug-2026 Release 1, Samsung's August 2026 Security Maintenance Release covering all prior unpatched firmware builds. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS 4.0 score of 4.4 reflects the strictly local attack surface and bounded impact scope.
AppLock on Samsung Mobile Devices prior to SMR Aug-2026 Release 1 exposes improperly exported Android application components, enabling a physical attacker to bypass the app lock protection layer entirely. The flaw grants access to confidentiality- and integrity-sensitive data within locked applications without satisfying the intended authentication challenge. No public exploit is identified at time of analysis; exploitation is constrained to physical device access, limiting but not eliminating real-world risk for lost or stolen device scenarios.
SemClipboardService on Samsung Mobile Devices prior to SMR Aug-2026 Release 1 exposes an authorization bypass that allows a locally authenticated attacker to read clipboard contents without the expected permission check. The flaw is confined to Samsung's proprietary clipboard service and does not affect stock Android builds. No public exploit has been identified at time of analysis, and no active exploitation is listed in CISA KEV.
Samsung Dialer on Samsung Mobile Devices prior to SMR Aug-2026 Release 1 exposes SIM-related functions to remote attackers through improper input validation, requiring user interaction to trigger. The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:P/VC:H) classifies this as a network-reachable, high-confidentiality-impact flaw, though high attack complexity and specific prerequisites substantially reduce the realistic threat surface. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Samsung Contacts on Samsung Mobile Devices prior to SMR Aug-2026 Release 1 exposes contact data across Android user profiles to an attacker with physical device access, due to improper input validation that fails to enforce inter-profile data isolation. The CVSS 4.0 vector confirms both the physical access prerequisite (AV:P) and the scope extension to a secondary user's data (SC:H), consistent with a profile boundary bypass in a multi-user Android environment. No public exploit code or active exploitation has been identified at time of analysis.
Unauthorized file deletion via improperly exported Android components in Samsung Contacts prior to SMR Aug-2026 Release 1 allows any locally-installed malicious application to invoke the exported component and delete files under Samsung Contacts' privilege without requiring any elevated permissions of its own. The vulnerability stems from an Android component export misconfiguration, granting third-party apps unintended access to privileged file operations. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and absence of privilege requirements make this straightforward to exploit on affected devices.
Improper input validation in Samsung Contacts on Samsung Mobile devices prior to SMR Aug-2026 Release 1 enables local attackers to delete files under Samsung Contacts' process privilege, bypassing the Android sandbox boundary between applications. The CVSS 4.0 score of 6.9 with VI:H reflects high integrity impact on the vulnerable system, though the local attack vector constrains opportunistic exploitation. No public exploit code exists and the vulnerability is not listed in CISA KEV at time of analysis; Samsung has released a fix in the August 2026 Security Maintenance Release.
Improper authorization in Samsung's AppBlock application on Android 15 and 16 devices allows a local, low-privileged attacker to launch arbitrary Android Activities without proper permission checks. Exploitation requires passive user interaction (CVSS 4.0 UI:P) and local device access, but the confidentiality impact on the vulnerable system is rated High (VC:H), consistent with the reported Information Disclosure tag. No public exploit code exists and the vulnerability is not listed in CISA's KEV catalog at time of analysis; Samsung has released a patch in SMR Jun-2026 Release 1.
Improper access control in the MediaTek Audio HAL on Samsung Mobile Devices running Android 14, 15, and 16 permits local unprivileged attackers to invoke restricted privileged functions within the audio subsystem. The CVSS 4.0 subsequent system impact is rated High across confidentiality, integrity, and availability (SC:H/SI:H/SA:H), indicating that successful exploitation can cascade well beyond the Audio HAL itself to compromise broader device system components. No public exploit identified at time of analysis; Samsung has released a fix in SMR Jun-2026 Release 1.
Improper Android component export in Samsung's Galaxy Editing Service exposes privileged operations to local, low-privileged attackers on Android 14, 15, and 16 devices prior to SMR Jun-2026 Release 1. A malicious app installed on the device can directly invoke these exported components - bypassing intended permission controls - to execute operations with elevated privileges, resulting in high integrity impact on the vulnerable system. No public exploit identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog.
Improper access control in the AuditLogService component of Samsung Mobile Devices running Android 16 exposes sensitive audit log information to local attackers. The flaw, disclosed and patched by Samsung Mobile as part of their June 2026 Security Maintenance Release (SMR Jun-2026 Release 1), enables a local attacker without special privileges to both read and potentially modify sensitive data surfaced by the audit logging subsystem. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
ImsSettings on Samsung Mobile Devices (Android 14, 15, 16) exposes an improperly exported Android application component, enabling locally authenticated low-privilege attackers to invoke the component and trigger its logging function, resulting in limited information disclosure. The vulnerability is patched in Samsung's SMR Jun-2026 Release 1 and is reported exclusively by Samsung Mobile. No public exploit code and no CISA KEV listing have been identified at time of analysis, and the CVSS 4.0 score of 4.8 (Medium) reflects the narrow, local-only impact.
Improper export of Android application components in Samsung's SpriteWallpaper app enables local attackers without privileges to access sensitive information and achieve disproportionately high impact on subsequent system components. Devices running Android 16 prior to the SMR Jun-2026 Release 1 security update are affected. No public exploit has been identified at time of analysis, but the zero-privilege local requirement and high subsequent system impact (SC:H/SI:H/SA:H) elevate practical risk on shared or managed Android devices.
Incorrect privilege assignment in the Telephony component of Samsung Mobile devices prior to SMR Jun-2026 Release 1 permits local attackers to access sensitive information without requiring prior privileges or user interaction. Affecting devices running Android 14, 15, and 16, the flaw stems from improper access controls within the telephony subsystem. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog, but the low attack complexity and absence of privilege prerequisites lower the bar for local exploitation.
Improper privilege handling in Samsung's SecTelephonyProvider component allows local attackers on Samsung Mobile Devices to access files that should be restricted to privileged processes. Affected devices run Android 14, 15, and 16 prior to the SMR Jun-2026 Release 1 patch, spanning the full current Samsung Android support matrix. No public exploit code exists and no KEV listing has been issued; the CVSS 4.0 score of 4.6 reflects constrained real-world impact due to required local access and active user interaction.
Improper permission handling in the Routines automation feature on Samsung Mobile Devices exposes sensitive information to local attackers without requiring elevated privileges. Affected devices run Samsung One UI on Android 15 and Android 16, prior to the SMR May-2026 Release 1 security update. No public exploit has been identified at time of analysis, and CISA's SSVC framework classifies current exploitation as none, consistent with an EPSS score at the 3rd percentile.
Improper input validation in the Routines feature on Samsung Mobile Devices (Android 16) enables a physical attacker to launch privileged activities outside normal authorization boundaries. Affected devices are those running any build prior to SMR May-2026 Release 1, as confirmed by Samsung Mobile Security. No public exploit exists at time of analysis, and EPSS at 0.04% (13th percentile) reflects the negligible likelihood of widespread exploitation given the mandatory physical access requirement.
OmaCP on Samsung Android devices (Android 14, 15, and 16) exposes improperly exported application components that allow any co-resident local application to invoke privileged functions without holding the required permissions. The flaw is rooted in Android's IPC mechanism, where components lacking proper access control declarations can be targeted by crafted intents from other installed apps. No public exploit code has been identified at the time of analysis, and EPSS sits at 0.01% (3rd percentile), consistent with SSVC's exploitation status of none; risk is real but bounded by the local attack vector.
Out-of-bounds memory write in Samsung's SveService component allows local attackers holding high privileges to execute arbitrary code on affected devices. Impacting Samsung Mobile Devices running Android 14, 15, and 16 prior to SMR May-2026 Release 1, exploitation is constrained to local privileged actors, substantially limiting real-world attack surface. No public exploit code exists and no confirmed active exploitation has been reported; EPSS places this at the 3rd percentile (0.01%), consistent with the elevated barrier to entry.
Incorrect privilege assignment in the LocationManager component of Samsung Mobile Devices (Android 14, 15, and 16) enables local attackers to access sensitive information without holding the requisite Android permissions. The flaw is addressed in Samsung's SMR May-2026 Release 1 security update. No public exploit code exists, EPSS stands at the 3rd percentile, and CISA has not listed this in the KEV catalog, placing it in a low-urgency category despite the broad Samsung device footprint.
FactoryCamera on Samsung Mobile Devices prior to SMR May-2026 Release 1 exposes a unique device identifier to local low-privileged attackers due to incorrect default file or resource permissions (CWE-276). Affected platforms span Android 14, 15, and 16. The vulnerability carries a CVSS 4.0 score of 6.8 with high confidentiality impact on the vulnerable system, though real-world risk is substantially tempered by the requirement for local device access, an EPSS of 0.01% (1st percentile), and SSVC classification of exploitation: none. No public exploit code or active exploitation has been identified at time of analysis.
PackageManagerService on Samsung Mobile Devices running Android 14, 15, and 16 allows local attackers without elevated privileges to bypass application installation restrictions by exploiting insufficient verification of data authenticity. The affected component fails to adequately validate the integrity of data governing app installation policies, enabling unauthorized modification of those restrictions on unpatched devices. No public exploit code has been identified and SSVC rates exploitation as none, but the impact is significant in enterprise MDM and parental-control deployments where installation restrictions are an active security control.
Improper input validation in Samsung Mobile Retail Mode prior to SMR April 2026 Release 1 allows local attackers with limited privileges to trigger privileged functions, potentially leading to information disclosure and unauthorized modification of device state. The vulnerability requires physical or local access and low-privilege credentials, limiting immediate remote exploitation risk but posing significant concern for retail environments where devices are physically accessible to untrusted parties.
Samsung Mobile S Share application prior to the April 2026 SMR Release 1 exposes sensitive information to adjacent network attackers without requiring authentication, achieved through a low-complexity attack requiring only user interaction. The vulnerability has a CVSS 5.1 score reflecting limited confidentiality impact over an adjacent network, and is addressed in the April 2026 security patch release.
External control of file name in Samsung AODManager prior to April 2026 SMR Release 1 allows privileged local attackers to create files with system privileges, potentially leading to privilege escalation or system compromise. The vulnerability requires high-level local privileges and affects Samsung Mobile devices through a path traversal or file name manipulation flaw in the AODManager component. No public exploit code has been identified at the time of analysis.
Bluetooth maintenance mode in Samsung Mobile devices prior to April 2026 SMR Release 1 permits physical attackers to bypass Extend Unlock authentication due to incorrect privilege assignment, enabling unauthorized device access without requiring prior authentication. The vulnerability requires physical proximity and user interaction but grants full confidentiality and integrity compromise of the device. No public exploit code has been identified at the time of analysis.
Samsung Mobile's Recents application prior to SMR Apr-2026 Release 1 fails to properly validate exceptional conditions, allowing a physical attacker to bypass App Pinning security controls. The vulnerability requires physical device access and has a CVSS score of 4.1 reflecting the physical attack vector and confidentiality impact; no public exploit code or confirmed active exploitation has been identified.
Device Care in Samsung Mobile devices prior to the April 2026 SMR Release 1 contains an improper exception handling vulnerability that permits physical attackers to bypass Knox Guard authentication enforcement. With a CVSS score of 4.4 and attack vector requiring physical access, this vulnerability poses a localized but serious integrity and confidentiality risk to device security architecture, particularly for devices left unattended or in corporate environments where physical access controls may be compromised.
Samsung DeX prior to the April 2026 Release 1 update contains improper access control that allows physical attackers to access hidden notification contents on affected Samsung mobile devices. The vulnerability requires direct physical access to the device but carries high scope and information integrity impact due to potential exposure of sensitive notification data. No public exploit code has been identified at the time of analysis.
Improper input validation in Samsung Mobile devices prior to SMR April 2026 Release 1 allows physical attackers to bypass network restrictions without authentication. The vulnerability affects data handling related to network restriction policies, enabling unauthorized modification of network access controls. CVSS score of 5.2 reflects the physical attack requirement, though integrity and availability impacts are rated high for affected functions.
An improper authorization vulnerability in Samsung Settings allows a local attacker with low privileges to disable configuration of background data usage for applications prior to the SMR Mar-2026 Release 1 patch. While the CVSS score of 4.8 is moderate, the vulnerability has limited impact as it only affects the integrity of data usage settings without enabling data exfiltration or system compromise. The local attack vector and requirement for user-level privileges significantly reduce real-world exploitation likelihood compared to remote or privilege-escalation vulnerabilities.
ThemeManager prior to the SMR Mar-2026 Release 1 contains an improper privilege management vulnerability that allows local privileged attackers to inappropriately reuse trial contents, potentially circumventing licensing restrictions or trial period limitations. With a CVSS score of 6.7 and requiring high privileges (PR:H) but no user interaction, this vulnerability poses a moderate integrity risk in environments where multiple privileged users share access to ThemeManager systems. No public proof-of-concept or active exploitation has been reported in the CVE record, and this does not appear on CISA's KEV catalog, suggesting limited real-world weaponization at present.
This vulnerability involves improper cryptographic signature verification in the Font Settings component of Samsung devices prior to the March 2026 Security Update Release 1. A physical attacker can bypass signature validation to install custom fonts, potentially leading to integrity compromise of system font resources. While the CVSS score is moderate at 5.1, the attack requires physical access and user interaction, limiting real-world exploitation frequency.
A broadcast receiver in Android Settings fails to properly verify intents prior to the March 2026 Security Maintenance Release 1, allowing a local attacker with limited privileges to launch arbitrary activities with Settings-level permissions. The vulnerability requires user interaction to trigger and carries a CVSS 4.0 score of 6.8, reflecting high confidentiality and integrity impact. No public exploit or KEV designation is currently documented, but the local attack vector and privilege escalation potential warrant prompt patching.