CVE-2026-21043 is a path traversal vulnerability (CWE-35) in the Wallpaper service of Samsung Mobile Devices. It affects versions prior to the SMR Jul-2026 Release 1 and enables local attackers with elevated privileges to access files with system server privileges. The vulnerability is rated medium severity with a CVSS 4.0 score of 6.7, indicating a local attack vector with low attack complexity and high impact on confidentiality. There is no vendor advisory or patch information available at this time.

Local privileged attackers can exploit this vulnerability to access arbitrary files with system server privileges, potentially leading to unauthorized disclosure of sensitive information. The vulnerability does not require user interaction and has a low attack complexity, but it requires the attacker to already have elevated privileges on the device.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict local privileged access to trusted users only and monitor for suspicious activity related to the Wallpaper service.