Samsung Mobile Devices

Improper input validation in the Galaxy Themes application on Samsung Mobile Devices allows a physical attacker to launch arbitrary Android activities, with a high confidentiality impact on the vulnerable system. Affected devices are those running Galaxy Themes prior to the SMR Aug-2026 Release 1 security update. The vulnerability is tagged as an information disclosure issue, and while it requires physical device access and active user interaction, exploitation could allow access to sensitive device data or protected application screens that would otherwise be restricted. No public exploit has been identified at time of analysis, and no KEV listing exists.

Out-of-bounds memory write in the VC1 codec implementation within libsavsvc.so on Samsung Mobile Devices exposes affected handsets to local memory corruption with limited but confirmed multi-property impact. Devices running Samsung firmware prior to SMR Aug-2026 Release 1 are vulnerable, with the flaw addressable by updating to the August 2026 Samsung Monthly Release. No public exploit code has been identified and the vulnerability is absent from CISA KEV, indicating no confirmed active exploitation at time of analysis.

Out-of-bounds memory write in Samsung Mobile Devices' MPEG4 codec library libsavsvc.so enables local attackers with no special privileges to corrupt memory, potentially leading to code execution or service disruption across affected system components. All Samsung Mobile Devices running firmware prior to SMR Aug-2026 Release 1 are exposed via this improper input validation flaw in the proprietary media codec. No public exploit code has been identified at time of analysis, but the low attack complexity and absence of privilege requirements lower the bar for exploitation on any affected device with an unprivileged app installed.

Samsung Message on Android devices prior to SMR Aug-2026 Release 1 exposes sensitive user information to physical attackers through improper input validation. An attacker with physical access to an unlocked or accessible device can interact with the Samsung Message application to trigger the flaw and read confidential message content or related data. No public exploit code has been identified, and exploitation requires hands-on device access, limiting widespread automated abuse.

Out-of-bounds memory write in Samsung's VC1 codec library libsavsvc.so allows local attackers to corrupt process memory on affected Samsung mobile devices. The root cause is an incorrect numeric type conversion during VC1 video decoding, a class of error that can produce exploitable integer truncation or overflow conditions leading to heap or stack corruption. No public exploit code has been identified at time of analysis, and the vendor has addressed this in the SMR Aug-2026 Release 1 security update.

Stack-based buffer overflow in libril_sem.so - Samsung's Radio Interface Layer shared library - enables privileged local attackers to execute arbitrary code on affected Samsung Mobile Devices prior to SMR Aug-2026 Release 1. The CVSS 4.0 vector (AV:L/PR:H) confirms exploitation requires established local access with high privileges, limiting the realistic attacker pool to already-compromised or insider-threat scenarios. No public exploit code or CISA KEV listing has been identified at time of analysis.

Out-of-bounds memory write in libsmsd.so affects all Samsung Mobile Devices running firmware prior to SMR Aug-2026 Release 1, exploitable by a local unprivileged attacker with no special privileges required. The flaw in Samsung's SMS daemon shared library allows memory corruption that could destabilize the smsd process or, with additional technique, enable code execution within the daemon's privilege context. No public exploit identified at time of analysis, and no CISA KEV listing; however, low attack complexity combined with zero privilege requirements makes this actionable for any malicious app or shell-level actor on an unpatched device.

Out-of-bounds memory write in Samsung's libcodec2_sec_flacdec.so FLAC decoder library exposes Samsung Mobile Devices to local exploitation on firmware prior to the SMR Aug-2026 Release 1 patch. The root cause is improper input validation in the secure FLAC decoding component, allowing a local attacker to write beyond allocated memory boundaries and potentially corrupt adjacent memory. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists for this CVE.

Out-of-bounds write in Samsung's libcodec2secqcelpdec.so QCELP audio codec decoder library allows local attackers holding low-privilege execution on affected Samsung devices to corrupt adjacent memory regions, with limited confidentiality, integrity, and availability impact confined to the vulnerable system. The flaw is addressed in SMR Aug-2026 Release 1, Samsung's August 2026 Security Maintenance Release covering all prior unpatched firmware builds. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS 4.0 score of 4.4 reflects the strictly local attack surface and bounded impact scope.

Improper access control in the Weaver component of Samsung Mobile devices allows a local attacker without elevated privileges to render the device inoperable, achieving high integrity and availability impact. All Samsung Mobile devices running Weaver prior to the SMR Aug-2026 Release 1 security update are affected. No public exploit code or active exploitation has been confirmed at time of analysis, but the low attack complexity and absence of privilege requirements lower the bar for abuse by a local threat actor.

AppLock on Samsung Mobile Devices prior to SMR Aug-2026 Release 1 exposes improperly exported Android application components, enabling a physical attacker to bypass the app lock protection layer entirely. The flaw grants access to confidentiality- and integrity-sensitive data within locked applications without satisfying the intended authentication challenge. No public exploit is identified at time of analysis; exploitation is constrained to physical device access, limiting but not eliminating real-world risk for lost or stolen device scenarios.

SemClipboardService on Samsung Mobile Devices prior to SMR Aug-2026 Release 1 exposes an authorization bypass that allows a locally authenticated attacker to read clipboard contents without the expected permission check. The flaw is confined to Samsung's proprietary clipboard service and does not affect stock Android builds. No public exploit has been identified at time of analysis, and no active exploitation is listed in CISA KEV.

Samsung Dialer on Samsung Mobile Devices prior to SMR Aug-2026 Release 1 exposes SIM-related functions to remote attackers through improper input validation, requiring user interaction to trigger. The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:P/VC:H) classifies this as a network-reachable, high-confidentiality-impact flaw, though high attack complexity and specific prerequisites substantially reduce the realistic threat surface. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Samsung Contacts on Samsung Mobile Devices prior to SMR Aug-2026 Release 1 exposes contact data across Android user profiles to an attacker with physical device access, due to improper input validation that fails to enforce inter-profile data isolation. The CVSS 4.0 vector confirms both the physical access prerequisite (AV:P) and the scope extension to a secondary user's data (SC:H), consistent with a profile boundary bypass in a multi-user Android environment. No public exploit code or active exploitation has been identified at time of analysis.

Unauthorized file deletion via improperly exported Android components in Samsung Contacts prior to SMR Aug-2026 Release 1 allows any locally-installed malicious application to invoke the exported component and delete files under Samsung Contacts' privilege without requiring any elevated permissions of its own. The vulnerability stems from an Android component export misconfiguration, granting third-party apps unintended access to privileged file operations. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and absence of privilege requirements make this straightforward to exploit on affected devices.

Improper input validation in Samsung Contacts on Samsung Mobile devices prior to SMR Aug-2026 Release 1 enables local attackers to delete files under Samsung Contacts' process privilege, bypassing the Android sandbox boundary between applications. The CVSS 4.0 score of 6.9 with VI:H reflects high integrity impact on the vulnerable system, though the local attack vector constrains opportunistic exploitation. No public exploit code exists and the vulnerability is not listed in CISA KEV at time of analysis; Samsung has released a fix in the August 2026 Security Maintenance Release.

We need to produce a comprehensive analysis for CVE-2026-21047. Let's gather all provided data: CVE ID, description: "Out-of-bounds write in ImsService prior to SMR Jul-2026 Release 1 allows remote attackers to potentially execute arbitrary code." CVSS Score 8.3 (but note vector is CVSS:4.0, not 3.1, although score provided as 8.3, which is moderate? Actually CVSS 4.0 base score 8.3 is high, not critical). Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N. CWE N/A. Multi-source: Reported by SamsungMobile, CPE: cpe:2.3:a:samsung_mobile:samsung_mobile_devices:*:*:*:*:*:*:*:* (no version bound). Tags: RCE, Buffer Overflow, Samsung Mobile Devices. References: [cveorg] (None) https://security.samsungmobile.com/securityUpdate.smsb?year=2026&month=07. No KEV status mentioned, no EPSS, no POC availability in input. So exploitation status: "no public exploit identified at time of analysis". No patch version explicitly given except "prior to SMR Jul-2026 Release 1", which implies fix in that release. So patch status: "Vendor-released patch: SMR Jul-2026 Release 1". However, we need to check if the patch version is exact. The description says "prior to SMR Jul-2026 Release 1", meaning the fix is in that release. So we can state the patched version is "SMR Jul-2026 Release 1". But we need to be precise: "SMR Jul-2026 Release 1" is a version string for Samsung Mobile devices security maintenance release. So remediation: upgrade to SMR Jul-2026 Release 1. No workarounds mentioned. No EPSS, so risk assessment must note the CVSS 4.0 vector but we need to produce an assessed CVSS 3.1 vector as well? The output includes "assessed_cvss_vector" (3.1) and "assessed_cvss40_vector". I need to independently assess the vulnerability based on description and conditions. The description: Out-of-bounds write in ImsService prior to SMR Jul-2026 Release 1 allows remote attackers to potentially execute arbitrary code. The CVSS 4.0 provided: AV:N, AC:L, AT:P, PR:N, UI:N, VC:N

Improper authorization in Samsung's AppBlock application on Android 15 and 16 devices allows a local, low-privileged attacker to launch arbitrary Android Activities without proper permission checks. Exploitation requires passive user interaction (CVSS 4.0 UI:P) and local device access, but the confidentiality impact on the vulnerable system is rated High (VC:H), consistent with the reported Information Disclosure tag. No public exploit code exists and the vulnerability is not listed in CISA's KEV catalog at time of analysis; Samsung has released a patch in SMR Jun-2026 Release 1.

Improper access control in the AuditLogService component of Samsung Mobile Devices running Android 16 exposes sensitive audit log information to local attackers. The flaw, disclosed and patched by Samsung Mobile as part of their June 2026 Security Maintenance Release (SMR Jun-2026 Release 1), enables a local attacker without special privileges to both read and potentially modify sensitive data surfaced by the audit logging subsystem. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Incorrect privilege assignment in the Telephony component of Samsung Mobile devices prior to SMR Jun-2026 Release 1 permits local attackers to access sensitive information without requiring prior privileges or user interaction. Affecting devices running Android 14, 15, and 16, the flaw stems from improper access controls within the telephony subsystem. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog, but the low attack complexity and absence of privilege prerequisites lower the bar for local exploitation.

Improper privilege handling in Samsung's SecTelephonyProvider component allows local attackers on Samsung Mobile Devices to access files that should be restricted to privileged processes. Affected devices run Android 14, 15, and 16 prior to the SMR Jun-2026 Release 1 patch, spanning the full current Samsung Android support matrix. No public exploit code exists and no KEV listing has been issued; the CVSS 4.0 score of 4.6 reflects constrained real-world impact due to required local access and active user interaction.

Improper permission handling in the Routines automation feature on Samsung Mobile Devices exposes sensitive information to local attackers without requiring elevated privileges. Affected devices run Samsung One UI on Android 15 and Android 16, prior to the SMR May-2026 Release 1 security update. No public exploit has been identified at time of analysis, and CISA's SSVC framework classifies current exploitation as none, consistent with an EPSS score at the 3rd percentile.

Improper input validation in the Routines feature on Samsung Mobile Devices (Android 16) enables a physical attacker to launch privileged activities outside normal authorization boundaries. Affected devices are those running any build prior to SMR May-2026 Release 1, as confirmed by Samsung Mobile Security. No public exploit exists at time of analysis, and EPSS at 0.04% (13th percentile) reflects the negligible likelihood of widespread exploitation given the mandatory physical access requirement.

OmaCP on Samsung Android devices (Android 14, 15, and 16) exposes improperly exported application components that allow any co-resident local application to invoke privileged functions without holding the required permissions. The flaw is rooted in Android's IPC mechanism, where components lacking proper access control declarations can be targeted by crafted intents from other installed apps. No public exploit code has been identified at the time of analysis, and EPSS sits at 0.01% (3rd percentile), consistent with SSVC's exploitation status of none; risk is real but bounded by the local attack vector.

Local privilege escalation in Samsung Galaxy Watch allows unprivileged local attackers to execute arbitrary code with system-level privileges by exploiting improper input validation in the FacAtFunction component. Affects Galaxy Watch devices running Android Watch 14 and 16 prior to Samsung's May 2026 security release (SMR May-2026 Release 1). EPSS score of 0.03% indicates low automated exploitation probability, and no active exploitation or public POC has been identified at time of analysis. Attack requires physical or ADB access to the device.

Out-of-bounds memory write in Samsung's SveService component allows local attackers holding high privileges to execute arbitrary code on affected devices. Impacting Samsung Mobile Devices running Android 14, 15, and 16 prior to SMR May-2026 Release 1, exploitation is constrained to local privileged actors, substantially limiting real-world attack surface. No public exploit code exists and no confirmed active exploitation has been reported; EPSS places this at the 3rd percentile (0.01%), consistent with the elevated barrier to entry.

Incorrect privilege assignment in the LocationManager component of Samsung Mobile Devices (Android 14, 15, and 16) enables local attackers to access sensitive information without holding the requisite Android permissions. The flaw is addressed in Samsung's SMR May-2026 Release 1 security update. No public exploit code exists, EPSS stands at the 3rd percentile, and CISA has not listed this in the KEV catalog, placing it in a low-urgency category despite the broad Samsung device footprint.

FactoryCamera on Samsung Mobile Devices prior to SMR May-2026 Release 1 exposes a unique device identifier to local low-privileged attackers due to incorrect default file or resource permissions (CWE-276). Affected platforms span Android 14, 15, and 16. The vulnerability carries a CVSS 4.0 score of 6.8 with high confidentiality impact on the vulnerable system, though real-world risk is substantially tempered by the requirement for local device access, an EPSS of 0.01% (1st percentile), and SSVC classification of exploitation: none. No public exploit code or active exploitation has been identified at time of analysis.

PackageManagerService on Samsung Mobile Devices running Android 14, 15, and 16 allows local attackers without elevated privileges to bypass application installation restrictions by exploiting insufficient verification of data authenticity. The affected component fails to adequately validate the integrity of data governing app installation policies, enabling unauthorized modification of those restrictions on unpatched devices. No public exploit code has been identified and SSVC rates exploitation as none, but the impact is significant in enterprise MDM and parental-control deployments where installation restrictions are an active security control.

Improper input validation in Samsung Mobile Retail Mode prior to SMR April 2026 Release 1 allows local attackers with limited privileges to trigger privileged functions, potentially leading to information disclosure and unauthorized modification of device state. The vulnerability requires physical or local access and low-privilege credentials, limiting immediate remote exploitation risk but posing significant concern for retail environments where devices are physically accessible to untrusted parties.

Samsung Mobile S Share application prior to the April 2026 SMR Release 1 exposes sensitive information to adjacent network attackers without requiring authentication, achieved through a low-complexity attack requiring only user interaction. The vulnerability has a CVSS 5.1 score reflecting limited confidentiality impact over an adjacent network, and is addressed in the April 2026 security patch release.

External control of file name in Samsung AODManager prior to April 2026 SMR Release 1 allows privileged local attackers to create files with system privileges, potentially leading to privilege escalation or system compromise. The vulnerability requires high-level local privileges and affects Samsung Mobile devices through a path traversal or file name manipulation flaw in the AODManager component. No public exploit code has been identified at the time of analysis.

Bluetooth maintenance mode in Samsung Mobile devices prior to April 2026 SMR Release 1 permits physical attackers to bypass Extend Unlock authentication due to incorrect privilege assignment, enabling unauthorized device access without requiring prior authentication. The vulnerability requires physical proximity and user interaction but grants full confidentiality and integrity compromise of the device. No public exploit code has been identified at the time of analysis.

Samsung Mobile's Recents application prior to SMR Apr-2026 Release 1 fails to properly validate exceptional conditions, allowing a physical attacker to bypass App Pinning security controls. The vulnerability requires physical device access and has a CVSS score of 4.1 reflecting the physical attack vector and confidentiality impact; no public exploit code or confirmed active exploitation has been identified.

Device Care in Samsung Mobile devices prior to the April 2026 SMR Release 1 contains an improper exception handling vulnerability that permits physical attackers to bypass Knox Guard authentication enforcement. With a CVSS score of 4.4 and attack vector requiring physical access, this vulnerability poses a localized but serious integrity and confidentiality risk to device security architecture, particularly for devices left unattended or in corporate environments where physical access controls may be compromised.

Improper input validation in Samsung Mobile devices prior to SMR April 2026 Release 1 allows physical attackers to bypass network restrictions without authentication. The vulnerability affects data handling related to network restriction policies, enabling unauthorized modification of network access controls. CVSS score of 5.2 reflects the physical attack requirement, though integrity and availability impacts are rated high for affected functions.

An improper authorization vulnerability in Samsung Settings allows a local attacker with low privileges to disable configuration of background data usage for applications prior to the SMR Mar-2026 Release 1 patch. While the CVSS score of 4.8 is moderate, the vulnerability has limited impact as it only affects the integrity of data usage settings without enabling data exfiltration or system compromise. The local attack vector and requirement for user-level privileges significantly reduce real-world exploitation likelihood compared to remote or privilege-escalation vulnerabilities.

ThemeManager prior to the SMR Mar-2026 Release 1 contains an improper privilege management vulnerability that allows local privileged attackers to inappropriately reuse trial contents, potentially circumventing licensing restrictions or trial period limitations. With a CVSS score of 6.7 and requiring high privileges (PR:H) but no user interaction, this vulnerability poses a moderate integrity risk in environments where multiple privileged users share access to ThemeManager systems. No public proof-of-concept or active exploitation has been reported in the CVE record, and this does not appear on CISA's KEV catalog, suggesting limited real-world weaponization at present.

A broadcast receiver in Android Settings fails to properly verify intents prior to the March 2026 Security Maintenance Release 1, allowing a local attacker with limited privileges to launch arbitrary activities with Settings-level permissions. The vulnerability requires user interaction to trigger and carries a CVSS 4.0 score of 6.8, reflecting high confidentiality and integrity impact. No public exploit or KEV designation is currently documented, but the local attack vector and privilege escalation potential warrant prompt patching.