This vulnerability (CVE-2026-21065) is an improper input validation issue (CWE-20) resulting in an out-of-bounds write within the libcodec2secqcelpdec.so component of Samsung Mobile Devices. It affects versions prior to the SMR August 2026 Release 1. The flaw allows local attackers with low privileges to write memory out-of-bounds, which could potentially lead to memory corruption. The CVSS 4.4 vector indicates local attack vector, low complexity, no user interaction, and limited impact on confidentiality, integrity, and availability. The affected component is part of a cloud service, and Samsung manages the patching process.

The vulnerability allows local attackers with limited privileges to perform out-of-bounds memory writes, which could lead to memory corruption. The CVSS score of 4.4 reflects a medium severity impact with limited confidentiality, integrity, and availability consequences. No active exploitation is known at this time.

Samsung manages remediation for this cloud-hosted service. A patch is available as of the SMR August 2026 Release 1. Users should ensure their devices are updated to this release or later to mitigate the vulnerability. No additional action is required beyond applying the official update.