This vulnerability (CVE-2026-21010) affects Samsung Mobile Devices by improper input validation in Retail Mode before the SMR April 2026 Release 1. It enables local attackers with low privileges to invoke privileged functions, potentially leading to full compromise of confidentiality, integrity, and availability. The CVSS 3.1 vector indicates the attack requires local access with low complexity and no user interaction. No vendor advisory or patch information is available to confirm remediation status.

Successful exploitation could allow a local attacker to execute privileged functions, resulting in complete compromise of the device's confidentiality, integrity, and availability. This could lead to unauthorized access to sensitive data, modification of system settings, or denial of service conditions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict local access to devices in Retail Mode and monitor for unusual activity related to privileged functions.