Threat database

CVE-2026-21119 is a medium severity vulnerability involving an out-of-bounds read and write in the lib_sag_ai_sound_sep_v2.00.so component of Samsung Mobile Devices. This flaw allows local attackers to access memory beyond intended boundaries. It affects versions prior to the SMR Oct-2026 Release 1. The vulnerability requires local privileges and has low attack complexity, with no user interaction needed. No known exploits are reported in the wild.

CVE-2026-21118 is an improper access control vulnerability in the DownloadProvider component of Samsung Mobile Devices. It affects versions prior to the SMR Oct-2026 Release 1. This flaw allows local attackers with limited privileges to access files within scoped storage, potentially exposing sensitive data. The vulnerability has a CVSS 4.0 base score of 6.9, indicating a medium severity. There are no known exploits in the wild at this time.

CVE-2026-21117 is an improper access control vulnerability in the CocktailBarService component of Samsung Mobile Devices prior to the SMR Oct-2026 Release 1. This flaw allows local attackers to access sensitive information without proper authorization. The vulnerability has a medium severity with a CVSS 4.0 score of 5.1. No specific affected versions or patches are provided in the available data.

CVE-2026-21116 is an out-of-bounds write vulnerability in the libsmkvextractor.so component of Samsung Mobile Devices. It affects versions prior to the SMR Oct-2026 Release 1. The flaw allows local attackers to write outside the intended memory bounds, potentially leading to memory corruption. The vulnerability has a medium severity with a CVSS 4.0 base score of 5.1. No known exploits are reported in the wild. No explicit patch or remediation details are provided in the available data.

CVE-2026-21115 is an out-of-bounds write vulnerability in the libcodec2-sec-flacdec.so component of Samsung Mobile Devices. It affects versions prior to the SMR Oct-2026 Release 1. The flaw allows local attackers to write outside the intended memory bounds, potentially leading to memory corruption. The vulnerability has a CVSS 4.0 base score of 5.1, indicating medium severity. A patch is available to address this issue. The vulnerability does not require user interaction and has no known exploits in the wild at this time.

CVE-2026-21114 is a high-severity vulnerability in Samsung Mobile Devices involving an out-of-bounds write in the libsmkvextractor.so component. This flaw exists in versions prior to the SMR Oct-2026 Release 1. It allows local attackers to execute arbitrary code on affected devices without requiring user interaction.

Improper access control in ManagedProvisioning prior to SMR Sep-2026 Release 1 allows local attackers to install arbitrary applications.

CVE-2026-21104 is a heap-based buffer overflow vulnerability in the KnoxVault trustlet component of Samsung Mobile Devices prior to the SMR Sep-2026 Release 1. It allows local privileged attackers to execute arbitrary code. The vulnerability has a high severity score of 7.1 according to CVSS 4.0. No specific affected versions or patch information is provided.

CVE-2026-21103 is a path traversal vulnerability in Samsung Mobile's GalaxyDiagnostics component prior to the SMR Sep-2026 Release 1. This flaw allows physical attackers to access files with system privileges on affected Samsung Mobile devices. The vulnerability has a CVSS 4.0 base score of 6.8, indicating medium severity. No specific affected versions or patch information is provided in the available data.

CVE-2026-21102 is a critical use-after-free vulnerability in the DualDAR component of Samsung Mobile Devices prior to the SMR September 2026 Release 1. It allows local privileged attackers to execute arbitrary code with root privileges. The vulnerability has a high CVSS 4.0 score of 9.3, indicating severe impact. No specific affected versions or patch information is provided in the available data.

CVE-2026-21101 is a high-severity vulnerability in Samsung Mobile Devices involving improper input validation in the DualDAR driver before the SMR Sep-2026 Release 1. It allows local privileged attackers to potentially execute arbitrary code with root privileges. The vulnerability requires local access and high privileges to exploit and does not involve user interaction. No patch or vendor advisory details are provided regarding remediation.

CVE-2026-21100 is an improper access control vulnerability in the SystemUI component of Samsung Mobile Devices prior to the SMR Sep-2026 Release 1. This flaw allows local attackers to launch arbitrary activities on affected devices. The vulnerability has a medium severity with a CVSS 4.0 base score of 6.9. No specific affected versions or patch information is provided in the available data.

CVE-2026-21099 is a medium severity vulnerability in Samsung Mobile Devices involving improper access control in the SettingsProvider component prior to the SMR Sep-2026 Release 1. This flaw allows local attackers to access sensitive information due to insufficient permission handling.

CVE-2026-21097 is an improper authorization vulnerability in Samsung Mobile Devices affecting the ActivityTaskManagerService component prior to the SMR Sep-2026 Release 1. It allows local privileged attackers to launch arbitrary activities without proper authentication. The vulnerability has a medium severity with a CVSS score of 4.6. No specific affected versions or patch information is provided.

CVE-2026-21089 is a medium severity vulnerability in Samsung Mobile Devices caused by improper input validation in the removal of style tags within the libsubextractor.so component. This flaw allows local attackers to write out-of-bounds memory, potentially leading to memory corruption. The issue affects versions prior to the SMR Sep-2026 Release 1. There is no explicit patch information provided in the source data.

CVE-2026-21088 is a medium severity vulnerability in Samsung Mobile Devices involving improper input validation in the libsubextractor.so component. This flaw allows local attackers to write out-of-bounds memory when loading a subtitle frame. The issue affects versions prior to the SMR Sep-2026 Release 1. No known exploits are reported in the wild, and no official patch information is provided.

CVE-2026-21087 is a high-severity out-of-bounds write vulnerability in the libmdnie.so component of Samsung Mobile Devices prior to the SMR September 2026 Release 1. This flaw allows local attackers to execute arbitrary code with system server privileges. The vulnerability has a CVSS 4.0 score of 8.6, indicating significant impact if exploited. No specific affected versions are provided, and no patch information is available in the input data.

CVE-2026-21085 is a high-severity out-of-bounds write vulnerability in the Keymaster trustlet component of Samsung Mobile Devices prior to the SMR Sep-2026 Release 1. It allows local privileged attackers to write outside the intended memory bounds, potentially leading to memory corruption. The vulnerability requires local privileged access and does not involve user interaction. No public exploits are known, and no specific affected versions are detailed.

CVE-2026-21084 is an improper access control vulnerability in Samsung Mobile's SmartThings application prior to version 1.8.47.24. This flaw allows local attackers with limited privileges to access sensitive information within the application. The vulnerability has a medium severity rating with a CVSS 4.0 base score of 6.9. No official patch or remediation guidance has been provided by the vendor at this time.

CVE-2026-21083 is an improper input validation vulnerability in Samsung Mobile Smart Switch software versions prior to 3.7.72.6. This flaw allows adjacent attackers to access sensitive data. The vulnerability has a medium severity rating with a CVSS score of 6.8. No official patch or remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time.