CVE-2026-21116: CWE-787 Out-of-bounds write in Samsung Mobile Samsung Mobile Devices

This vulnerability involves an out-of-bounds write in the libsmkvextractor.so library used by Samsung Mobile Devices. It affects versions prior to the SMR October 2026 Release 1. The flaw allows local attackers to write beyond allocated memory boundaries, which could lead to memory corruption. The CVSS 4.0 score is 5.1, indicating medium severity, with attack vector local and low complexity. No user interaction or privileges are required, but the attacker must have local access. There is no indication of active exploitation or available patches.

The vulnerability allows local attackers to perform out-of-bounds memory writes, which may lead to memory corruption and potentially impact device stability or security. However, the CVSS score and lack of known exploits suggest the impact is limited to local threat scenarios and is not trivially exploitable remotely.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor Samsung Mobile advisories for updates. No specific mitigations are indicated in the available data.