Threat database

Improper Validation of Specified Quantity in Input vulnerability in Samsung Open Source rlottie allows Input Data Manipulation.

Improper Validation of Specified Quantity in Input and Allocation of Resources Without Limits or Throttling vulnerability in Samsung Open Source rlottie allows Excessive Allocation.

CVE-2026-21084 is an improper access control vulnerability in Samsung Mobile's SmartThings application prior to version 1.8.47.24. This flaw allows local attackers with limited privileges to access sensitive information within the application. The vulnerability has a medium severity rating with a CVSS 4.0 base score of 6.9. No official patch or remediation guidance has been provided by the vendor at this time.

CVE-2026-21083 is an improper input validation vulnerability in Samsung Mobile Smart Switch software versions prior to 3.7.72.6. This flaw allows adjacent attackers to access sensitive data. The vulnerability has a medium severity rating with a CVSS score of 6.8. No official patch or remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time.

CVE-2026-21082 is a relative path traversal vulnerability in Samsung Health prior to version 7.0.0. This flaw allows local attackers to access sensitive information by manipulating file paths. The vulnerability has a CVSS 4.0 base score of 6.9, indicating a medium severity level. No official patch or remediation guidance has been provided yet, and there are no known exploits in the wild. The affected versions are not explicitly stated in the available data.

CVE-2026-21081 is a medium severity vulnerability in SamsungPassAutofill prior to version 5.2.10. It involves improper export of Android application components, which allows local attackers to access sensitive information. Exploitation requires user interaction. No official patch or remediation guidance is currently confirmed.

CVE-2026-21080 is a medium severity vulnerability in Samsung Mobile Smart Switch where sensitive information is stored in cleartext in versions prior to 3.7.72.6. This flaw allows adjacent attackers to access sensitive data due to improper storage practices. No official patch or remediation guidance has been provided yet.

CVE-2026-21079 is a vulnerability in Samsung Mobile Smart Switch where sensitive data transmitted by the application prior to version 3.7.72.6 is not encrypted. This allows adjacent attackers to intercept the transmitted data. The vulnerability has a high severity rating with a CVSS score of 7. No official patch or remediation guidance has been provided yet.

CVE-2026-21078 is a medium severity vulnerability in Samsung Mobile Smart Switch prior to version 3.7.72.6. It involves insufficient verification of data authenticity in the trouble scanning mode, which allows adjacent attackers to spoof device identity. No patch or official remediation has been confirmed yet. There are no known exploits in the wild at this time.

CVE-2026-21077 is an incorrect authorization vulnerability in Samsung Health versions prior to 7.0.0. It allows local attackers to access sensitive information without proper authorization. The vulnerability has a medium severity with a CVSS 4.0 base score of 6.9. No official patch or remediation guidance has been provided yet by the vendor. There are no known exploits in the wild at this time.

CVE-2026-21076 is an incorrect authorization vulnerability in Samsung Health versions prior to 7.0.0. This flaw allows local attackers to access sensitive information without proper authorization. The vulnerability has a medium severity rating with a CVSS score of 6.9. No official patch or remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time.

CVE-2026-21075 is a medium severity vulnerability in Samsung Mobile's My Galaxy application prior to version 6.3. It involves improper authorization in the handler for a custom URL scheme, which allows remote attackers to access sensitive information. No specific affected versions or patches have been confirmed. The vulnerability does not require privileges or user interaction for exploitation but has low impact on confidentiality and no impact on integrity or availability.

CVE-2026-21074 is a high-severity vulnerability in Samsung Mobile's Bixby prior to version 4.0.86.0. It involves incorrect default permissions that allow local attackers with limited privileges to execute arbitrary commands with Bixby-level privileges. This vulnerability does not require user interaction and has a high impact on confidentiality and integrity. No official patch or remediation guidance is currently confirmed from the vendor.

CVE-2026-21073 is a medium severity vulnerability in Samsung Mobile Devices affecting the Galaxy Themes component prior to the SMR Aug-2026 Release 1. It involves improper input validation that could allow a physical attacker to launch arbitrary activities on the device. No official patch or remediation guidance has been provided yet, and there are no known exploits in the wild.

CVE-2026-21072 is a medium severity vulnerability in Samsung Mobile Devices involving improper input validation in the VC1 codec component (libsavsvc.so). This flaw allows local attackers to write out-of-bounds memory, potentially leading to memory corruption. The issue affects versions prior to the SMR Aug-2026 Release 1. No official patch or remediation guidance is currently available from the vendor.

CVE-2026-21071 is a medium severity vulnerability in Samsung Mobile Devices involving improper input validation in the MPEG4 codec component (libsavsvc.so). This flaw allows local attackers to write out-of-bounds memory, potentially leading to memory corruption. The issue affects versions prior to the SMR Aug-2026 Release 1. No official patch or remediation guidance has been provided yet.

CVE-2026-21070 is a medium severity vulnerability in Samsung Mobile Devices affecting the Samsung Message application prior to the SMR August 2026 Release 1. It involves improper input validation (CWE-20) that could allow physical attackers to access sensitive information. No specific affected versions or patch information is provided. The vulnerability requires physical access and user interaction to exploit and does not involve network attack vectors.

CVE-2026-21069 is a medium severity vulnerability in Samsung Mobile Devices involving an incorrect conversion between numeric types in the VC1 codec component (libsavsvc.so). This flaw allows local attackers to write out-of-bounds memory, potentially leading to memory corruption. The issue affects versions prior to the Samsung Mobile SMR August 2026 Release 1. No official patch or remediation guidance has been provided yet, and there are no known exploits in the wild.

CVE-2026-21068 is a stack-based buffer overflow vulnerability in the libril_sem.so component of Samsung Mobile Devices prior to the SMR Aug-2026 Release 1. This flaw allows privileged local attackers to execute arbitrary code. The vulnerability has a high severity with a CVSS 4.0 score of 8.4. No specific affected versions or patch information is provided in the available data.

CVE-2026-21067 is a medium severity vulnerability in Samsung Mobile Devices caused by improper input validation in the libsmsd.so component. This flaw allows local attackers to write out-of-bounds memory, potentially leading to memory corruption. The issue affects versions prior to the SMR Aug-2026 Release 1. No official patch or remediation guidance has been provided yet, and there are no known exploits in the wild.