Threat database

CVE-2026-21066 is a medium severity vulnerability in Samsung Mobile Devices involving improper input validation in the libcodec2_sec_flacdec.so component prior to the SMR August 2026 Release 1. This flaw allows local attackers to write out-of-bounds memory. The vulnerability affects Samsung's cloud service environment, where the vendor manages remediation. No known exploits are reported in the wild.

Out-of-bounds write in libcodec2secqcelpdec.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory.

CVE-2026-21064 is an improper access control vulnerability in the Weaver component of Samsung Mobile Devices prior to the SMR August 2026 Release 1. This flaw allows local attackers to cause device inoperability. The vulnerability has a high severity score of 7. No patch or official remediation information is currently provided by the vendor. There are no known exploits in the wild at this time.

CVE-2026-21063 is a medium severity vulnerability in Samsung Mobile Devices related to improper export of Android application components in the AppLock feature prior to the SMR Aug-2026 Release 1. This flaw allows physical attackers to bypass the app lock function, potentially exposing locked applications. The vulnerability is identified as CWE-926, indicating improper export of components. No specific affected versions are provided, and no official patch or remediation guidance is currently available.

CVE-2026-21062 is an authorization bypass vulnerability in the SemClipboardService component of Samsung Mobile Devices prior to the SMR August 2026 Release 1. This flaw allows local attackers with limited privileges to access clipboard data without proper authorization. The vulnerability has a medium severity rating with a CVSS score of 4.8. No official patch or remediation guidance has been provided yet. There are no known exploits in the wild at this time.

CVE-2026-21061 is a medium severity vulnerability in Samsung Mobile Devices involving improper input validation in the Samsung Dialer application prior to the SMR Aug-2026 Release 1. This flaw allows remote attackers to access SIM-related functions, but requires user interaction to trigger. No official patch or remediation level has been confirmed yet.

CVE-2026-21060 is an improper input validation vulnerability in Samsung Contacts on Samsung Mobile Devices prior to the SMR Aug-2026 Release 1. This flaw allows physical attackers to access data across multiple user profiles. The vulnerability has a medium severity with a CVSS 4.0 score of 6.7. No specific affected versions or patch information is provided in the available data.

CVE-2026-21059 is a medium severity vulnerability affecting Samsung Contacts on Samsung Mobile Devices prior to the SMR Aug-2026 Release 1. It involves improper export of Android application components, which allows local attackers to delete files with the privileges of the Samsung Contacts app.

CVE-2026-21058 is a medium severity vulnerability in Samsung Contacts on Samsung Mobile Devices prior to the SMR Aug-2026 Release 1. It involves improper input validation that allows local attackers to delete files with the privileges of the Samsung Contacts app.

Improperly controlled sequential memory allocation vulnerability in Samsung Open Source rlottie allows Exponential Data Expansion.

Out-of-bounds write in ImsService prior to SMR Jul-2026 Release 1 allows remote attackers to potentially execute arbitrary code.

Integer overflow or wraparound vulnerability in Samsung Open Source rlottie allows Overflow Buffers. This issue affects .

Improper input validation in Samsung Pass prior to version 5.2.10.3 allows local privileged attackers to write out-of-bounds memory.

Improper authorization in Samsung Health prior to version 7.00.0.107 allows local attackers to access connected device information.

Improper export of android application components in Bixby prior to version 4.0.70.8 allows local attackers to execute arbitrary commands with Bixby privilege.

Improper export of android application components in InputSharing prior to version 2.7.01.4 allows local attackers to access sharing data.

Improper input validation in Samsung Email prior to version 6.2.13.1 allows local attackers to create arbitrary files within the application sandbox.