CVE-2026-21121: CWE-280: Improper handling of insufficient permission in Samsung Mobile Samsung Mobile Devices

The vulnerability identified as CVE-2026-21121 affects Samsung Mobile Devices. It is caused by improper handling of insufficient permission checks in the CmcCore module before the SMR Oct-2026 Release 1. This weakness (CWE-280) enables local attackers to invoke privileged APIs that should otherwise be restricted, potentially leading to unauthorized actions within the device environment. The CVSS 4.0 base score is 6.9, indicating medium severity, with attack vector local and low attack complexity. No user interaction or privileges are required for the attack, but the impact is limited to confidentiality.

Local attackers can exploit this vulnerability to access privileged APIs without proper permission checks. This may lead to unauthorized access to sensitive functions or data within the device. The impact is rated medium severity with a CVSS score of 6.9, primarily affecting confidentiality. There is no indication of integrity or availability impact.

No official patch or remediation details are provided in the available data. Patch status is not yet confirmed — check the Samsung Mobile vendor advisory for current remediation guidance. Until a fix is available, restrict local access to trusted users and monitor for suspicious activity involving privileged APIs.