CVE-2026-21119: CWE-125: Out-of-bounds Read in Samsung Mobile Samsung Mobile Devices

This vulnerability (CVE-2026-21119) involves an out-of-bounds read and write in the shared library lib_sag_ai_sound_sep_v2.00.so used in Samsung Mobile Devices. The flaw allows local attackers with limited privileges to access and modify memory beyond allocated boundaries, potentially leading to memory corruption or information disclosure. The issue affects versions prior to the SMR Oct-2026 Release 1. The CVSS 4.0 vector indicates low attack complexity and local attack vector with limited privileges required. No vendor advisory or patch link is provided, so patch status is not confirmed.

The vulnerability allows local attackers to read and write out-of-bounds memory, which can lead to memory corruption or unauthorized data access. The impact is limited by the requirement for local access and low privileges. There are no known exploits in the wild, and the severity is rated medium based on CVSS 4.0 score of 4.8.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability requires local access, restricting local user privileges and applying any available Samsung Mobile security updates, especially the SMR Oct-2026 Release 1 or later, is recommended once confirmed.