Threat database

CVE-2026-21037 is a medium severity vulnerability in Samsung Members prior to version 5.8.01.5. It involves improper input validation that allows local attackers to access arbitrary URLs and launch arbitrary activities with Samsung Members privileges.

CVE-2026-21036 is an improper authorization vulnerability in Samsung Internet browser versions prior to 30.0.0.39. This flaw allows local attackers to access sensitive information without proper authorization. The vulnerability has a medium severity rating with a CVSS 4.0 score of 6.3. No official patch or remediation guidance has been provided yet by the vendor. There are no known exploits in the wild at this time.

CVE-2026-21035 is an improper input validation vulnerability in Samsung Plus TV versions prior to 1.0.28.6. This flaw allows remote attackers to access sensitive information. The vulnerability has a medium severity rating with a CVSS 4.0 base score of 6.5. No official patch or remediation guidance has been provided yet by the vendor.

CVE-2026-21034 is a medium severity vulnerability in Samsung Auto affecting versions prior to 3.1.2.61 on Android 15 and prior to 3.2.0.38 on Android 16. It involves improper export of Android application components, which allows a local attacker with limited privileges to change audio configuration settings. There is no official patch or remediation level stated in the available data.

Improper export of android application components in ExpressHomeWidgetReceiver of Samsung Assistant prior to version 9.3.14 allows local attacker to execute arbitrary script.

Improper export of android application components in SmartHomeWidgetReceiver of Samsung Assistant prior to version 9.3.14 allows local attacker to execute arbitrary script.

Improper authorization in AppBlock prior to SMR Jun-2026 Release 1 allows local attacker to launch arbitrary activity. User interaction is required for triggering this vulnerability.

Improper access control in MediaTek Audio HAL prior to SMR Jun-2026 Release 1 allows local attackers to trigger privileged functions.

Improper export of android application components in Galaxy Editing Service prior to SMR Jun-2026 Release 1 allows local attacker to execute privileged operations.

Improper access control in AuditLogService prior to SMR Jun-2026 Release 1 allows local attackers to access sensitive information.

Improper export of android application components in ImsSettings prior to SMR Jun-2026 Release 1 allows local attackers to trigger logging function.

Improper export of android application components in SpriteWallpaper prior to SMR Jun-2026 Release 1 allows local attackers to access to sensitive information.

Incorrect privilege assignment in Telephony prior to SMR Jun-2026 Release 1 allows local attackers to access sensitive information.

Improper handling of insufficient privileges in SecTelephonyProvider prior to SMR Jun-2026 Release 1 allows local attackers to access privileged files.

CVE-2026-8916 is an out-of-bounds write vulnerability in the Samsung Open Source rlottie library that can lead to buffer overflow conditions. It affects versions before commit dcfde72eae1b0464dc0dd760aec00ada6a148635. The vulnerability requires local access with low attack complexity and user interaction. It has a CVSS 3.1 base score of 6.1, indicating medium severity. The impact includes integrity loss and high availability impact. No official patch or remediation guidance is currently available from the vendor.

Stack-based buffer overflow vulnerability in Samsung Open Source rlottie allows Overflow Buffers. This issue affects rlottie: before ce72b35a7ad0dded03051d3aa0ef75321c3bd035.

Uncontrolled Recursion vulnerability in Samsung Open Source rlottie allows Oversized Serialized Data Payloads. This issue affects rlottie: before e2d19e3b150e0e4a9586fa90b56fd3061cc98945.

Integer overflow or wraparound vulnerability in Samsung Open Source rlottie allows Integer Attacks. This issue affects rlottie: before 21292665023e5074b38254432716866d00f1985f.

Out-of-bounds read vulnerability in Samsung Open Source rlottie allows Overread Buffers. This issue affects rlottie: before 223a2a41ba4f462e4abe767bebba49a366c9b9fd.

Memory allocation with excessive size value vulnerability in Samsung Open Source rlottie allows Excessive Allocation. This issue affects rlottie: before 0b4e308fa88c72cbb60cc8a2c1d2c2ad89b101dd.