This vulnerability (CVE-2026-21058) is classified under CWE-20 (Improper Input Validation) and affects Samsung Contacts on Samsung Mobile Devices before the SMR Aug-2026 Release 1. The flaw allows a local attacker to delete files using the privileges granted to the Samsung Contacts application. The CVSS 4.0 base score is 6.9, indicating a medium severity level. There is no vendor advisory or patch information provided, and no known exploits in the wild have been reported.

A local attacker can leverage this vulnerability to delete files with the permissions of the Samsung Contacts application, potentially leading to data loss or disruption of contact-related functionality on the affected device. The impact is limited to local attackers and does not involve privilege escalation beyond the app's privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch information is provided, users and administrators should monitor Samsung's official security advisories for updates and apply the SMR Aug-2026 Release 1 or later once available.