Threat database

CVE-2026-21122 is a high-severity vulnerability involving an out-of-bounds write in the libsamsungtts.so component of Samsung Mobile Devices. This flaw exists in versions prior to the SMR Oct-2026 Release 1. It allows local attackers to execute arbitrary code on affected devices without requiring user interaction or elevated privileges.

CVE-2026-21121 is a medium severity vulnerability in Samsung Mobile Devices involving improper handling of insufficient permissions in the CmcCore component prior to the SMR Oct-2026 Release 1. This flaw allows local attackers to access privileged APIs without proper authorization.

CVE-2026-21120 is a use-after-free vulnerability in the WSM service of Samsung Mobile Devices prior to the SMR October 2026 Release 1. This flaw allows local attackers to potentially execute arbitrary code with system privileges. The vulnerability has a high severity score of 8.9 according to CVSS 4.0. No specific affected versions or patch information is provided.

CVE-2026-21119 is a medium severity vulnerability involving an out-of-bounds read and write in the lib_sag_ai_sound_sep_v2.00.so component of Samsung Mobile Devices. This flaw allows local attackers to access memory beyond intended boundaries. It affects versions prior to the SMR Oct-2026 Release 1. The vulnerability requires local privileges and has low attack complexity, with no user interaction needed. No known exploits are reported in the wild.

CVE-2026-21118 is an improper access control vulnerability in the DownloadProvider component of Samsung Mobile Devices. It affects versions prior to the SMR Oct-2026 Release 1. This flaw allows local attackers with limited privileges to access files within scoped storage, potentially exposing sensitive data. The vulnerability has a CVSS 4.0 base score of 6.9, indicating a medium severity. There are no known exploits in the wild at this time.

CVE-2026-21117 is an improper access control vulnerability in the CocktailBarService component of Samsung Mobile Devices prior to the SMR Oct-2026 Release 1. This flaw allows local attackers to access sensitive information without proper authorization. The vulnerability has a medium severity with a CVSS 4.0 score of 5.1. No specific affected versions or patches are provided in the available data.

CVE-2026-21116 is an out-of-bounds write vulnerability in the libsmkvextractor.so component of Samsung Mobile Devices. It affects versions prior to the SMR Oct-2026 Release 1. The flaw allows local attackers to write outside the intended memory bounds, potentially leading to memory corruption. The vulnerability has a medium severity with a CVSS 4.0 base score of 5.1. No known exploits are reported in the wild. No explicit patch or remediation details are provided in the available data.

CVE-2026-21115 is an out-of-bounds write vulnerability in the libcodec2-sec-flacdec.so component of Samsung Mobile Devices. It affects versions prior to the SMR Oct-2026 Release 1. The flaw allows local attackers to write outside the intended memory bounds, potentially leading to memory corruption. The vulnerability has a CVSS 4.0 base score of 5.1, indicating medium severity. A patch is available to address this issue. The vulnerability does not require user interaction and has no known exploits in the wild at this time.

CVE-2026-21114 is a high-severity vulnerability in Samsung Mobile Devices involving an out-of-bounds write in the libsmkvextractor.so component. This flaw exists in versions prior to the SMR Oct-2026 Release 1. It allows local attackers to execute arbitrary code on affected devices without requiring user interaction.

A heap-based buffer overflow vulnerability exists in Samsung Opensource rlottie, triggered via environment variables. This flaw can cause a denial of service by crashing the affected application. No confidentiality or integrity impacts are reported. The vulnerability has a medium severity score of 5.5 CVSS v3.1. No affected versions or patches are explicitly stated.

Improper access control in ManagedProvisioning prior to SMR Sep-2026 Release 1 allows local attackers to install arbitrary applications.

A threat actor exploited a path traversal vulnerability (CVE-2025-4632) in Samsung MagicINFO 9 Server to gain unauthorized access to endpoints. They deployed a rogue AnyDesk remote access tool, created a local administrator account, and disabled Microsoft Defender protections. Instead of deploying a pre-compiled cryptominer, the actor compiled a Monero cryptominer directly on the compromised endpoint using multiple compilers and utilities. The miner connected to the C3Pool mining service and ran under explorer.exe with suspicious arguments. This on-endpoint compilation generated significant endpoint detection and response (EDR) telemetry, increasing detectability despite attempts at stealth.

CVE-2026-92259 is an integer overflow or wraparound vulnerability in Samsung Opensource Escargot. It allows attackers with write access to the bytecode-cache directory to trigger a heap-based buffer overflow, leading to denial of service. The vulnerability affects a specific Escargot commit identified by ac94df78493ee6fede286620d94f724e46b4d238. No patch or remediation information is provided.

Stack-based buffer overflow vulnerability in Samsung Opensource rLottie allows attackers to overflow buffers, leading to memory corruption when rendering crafted vector animations. This issue affects rLottie: 480a2ad0c5d2e45458c545b8213279e9e8b71e39.

An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500, 2600, and 1680. A stack-based buffer overflow occurs when a malformed message is sent to the camera driver, causing a denial of service.

An issue was discovered in camera in Samsung Mobile Processor Exynos 1580 and 2500. An untrusted pointer dereference occurs when a malformed message is sent to the camera driver, causing limited information disclosure or denial of service.

An issue was discovered in Samsung Mobile Processor and Wearable Processor Exynos 1330, 1380, 1480, 1580, 1680, W920, W930, and W1000. . A malformed ioctl command to the Wi-Fi interface device can lead to improper buffer size allocation, resulting in an out-of-bounds write and causing a denial of service (DoS).

An issue was discovered in Wi-Fi in Samsung Mobile Processor Exynos 850, 1280, 1330, 1380, 1480, 2400, W920, and W930. A malformed Netlink command can trigger an out-of-bounds read, potentially leading to information leakage.

An issue was discovered in NR RRC and L2 in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 2500, 1680, W920, W930, W1000, and Modem 5410. In the 5G baseband, a NULL Pointer Dereference occurs when processing a malformed RRC Reconfiguration message.