CVE-2026-21122: CWE-787 Out-of-bounds write in Samsung Mobile Samsung Mobile Devices

This vulnerability is an out-of-bounds write in the libsamsungtts.so library of Samsung Mobile Devices, present before the SMR Oct-2026 Release 1. It enables local attackers to execute arbitrary code, potentially compromising device integrity. The CVSS 4.0 vector indicates local attack vector with low complexity, no privileges required, no user interaction, low vulnerability and high impact on integrity, and low impact on availability and confidentiality. No known exploits in the wild have been reported. The vulnerability is classified under CWE-787.

Successful exploitation allows local attackers to execute arbitrary code on affected Samsung Mobile Devices, potentially leading to full device compromise or unauthorized actions. The impact on confidentiality and availability is low, but the integrity impact is high. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The input data does not provide explicit patch or remediation information. Users should monitor Samsung Mobile advisories for updates and apply the SMR Oct-2026 Release 1 or later once available to address this issue.