Threat database

CVE-2026-21097 is an improper authorization vulnerability in Samsung Mobile Devices affecting the ActivityTaskManagerService component prior to the SMR Sep-2026 Release 1. It allows local privileged attackers to launch arbitrary activities without proper authentication. The vulnerability has a medium severity with a CVSS score of 4.6. No specific affected versions or patch information is provided.

CVE-2026-21089 is a medium severity vulnerability in Samsung Mobile Devices caused by improper input validation in the removal of style tags within the libsubextractor.so component. This flaw allows local attackers to write out-of-bounds memory, potentially leading to memory corruption. The issue affects versions prior to the SMR Sep-2026 Release 1. There is no explicit patch information provided in the source data.

CVE-2026-21088 is a medium severity vulnerability in Samsung Mobile Devices involving improper input validation in the libsubextractor.so component. This flaw allows local attackers to write out-of-bounds memory when loading a subtitle frame. The issue affects versions prior to the SMR Sep-2026 Release 1. No known exploits are reported in the wild, and no official patch information is provided.

CVE-2026-21087 is a high-severity out-of-bounds write vulnerability in the libmdnie.so component of Samsung Mobile Devices prior to the SMR September 2026 Release 1. This flaw allows local attackers to execute arbitrary code with system server privileges. The vulnerability has a CVSS 4.0 score of 8.6, indicating significant impact if exploited. No specific affected versions are provided, and no patch information is available in the input data.

CVE-2026-21085 is a high-severity out-of-bounds write vulnerability in the Keymaster trustlet component of Samsung Mobile Devices prior to the SMR Sep-2026 Release 1. It allows local privileged attackers to write outside the intended memory bounds, potentially leading to memory corruption. The vulnerability requires local privileged access and does not involve user interaction. No public exploits are known, and no specific affected versions are detailed.

CVE-2026-86315 is a numeric truncation error vulnerability in Samsung Open Source Escargot on Linux x86-64. It allows an attacker who can supply JavaScript for execution to cause an out-of-bounds write by providing a crafted class definition with an instance initialization entry count exceeding UINT16_MAX. This leads to native memory corruption and a crash of the host process. The vulnerability has a CVSS score of 6.2, indicating medium severity.

CVE-2026-86314 is an integer overflow vulnerability in the source-bounds check within the Memory::init() function of Samsung Opensource Walrus. This flaw allows a remote attacker to craft a WebAssembly module that triggers a 32-bit unsigned addition wraparound, bypassing bounds checks and causing an out-of-bounds heap read and denial of service. The vulnerability affects the Walrus component identified by commit ff3bf5ff5c4878f8e5572c9593d303f6bc997443. No affected versions or patches are explicitly stated.

CVE-2026-86313 is an out-of-bounds write vulnerability in Samsung Opensource Walrus. This flaw allows buffer overflow conditions that can lead to high impact on confidentiality, integrity, and availability. The vulnerability requires local access with low complexity and user interaction. It has been assigned a high severity score of 7.8. No specific affected versions or patches have been disclosed yet.

Out-of-bounds read vulnerability in Samsung Opensource rLottie allows Overread Buffers. This issue affects rLottie: 25648aef19187b3f87f4d9420b8d761453ad4630.

Out-of-bounds Write and Improper Validation of Array Index vulnerability in Samsung Open Source TizenFX Samsung/TizenFX allows Overflow Buffers.

Untrusted pointer dereference vulnerability in Samsung Open Source mTower allows Pointer Manipulation. This issue affects mTower: before 102d3dc75cf8e58e68e4bea54ae3c803992c91be.

Untrusted pointer dereference vulnerability in Samsung Open Source mTower allows Pointer Manipulation. This issue affects mTower: before 06994e303637512e39062f3e037c222e8448e57e.

NULL pointer dereference vulnerability in Samsung Open Source mTower allows Pointer Manipulation. This issue affects mTower: before afef59aa6f55c5d5ebf9b14bc020bf1c2c37489a.

CVE-2026-82797 is an uncontrolled recursion vulnerability in the Samsung Open Source rlottie library. It is triggered by serialized data containing nested payloads that cause excessive recursion, impacting availability. The vulnerability has a medium severity with a CVSS score of 5.5. It affects versions of rlottie before commit 8de0d9e6ca80ffef654965505981727b9fa06a51. No official patch or remediation guidance is currently available, and there are no known exploits in the wild.

Integer Overflow to Buffer Overflow vulnerability in Samsung Open Source rlottie allows Overflow Buffers.

Uncontrolled Resource Consumption vulnerability in Samsung Open Source rlottie allows Excessive Allocation.