This vulnerability (CVE-2026-21089) arises from improper input validation in the libsubextractor.so library used in Samsung Mobile Devices. Specifically, the issue occurs during the removal of style tags, which can lead to out-of-bounds memory writes by local attackers. The CVSS 4.0 base score is 6.9, indicating medium severity, with an attack vector limited to local access and requiring user interaction. The vulnerability is present in versions before the SMR Sep-2026 Release 1. No vendor advisory or patch information is currently available.

Successful exploitation allows a local attacker to write out-of-bounds memory, which could potentially lead to memory corruption. The CVSS vector indicates limited impact on confidentiality and availability but high impact on integrity. The attack requires local access and user interaction, limiting the scope of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should limit local access to trusted users and avoid executing untrusted inputs that might trigger the vulnerability.