Improper export of android application components in Samsung Dialer prior to SMR Feb-2026 Release 1 allows local attackers to launch arbitrary activity with Samsung Dialer privilege.
CVE-2026-20982 is a medium severity path traversal vulnerability in Samsung Mobile devices' ShortcutService component prior to the SMR February 2026 Release 1. It allows a privileged local attacker to create files with system-level privileges by exploiting improper input validation. The vulnerability requires local access with high privileges but does not require user interaction or authentication beyond that. Although no known exploits are currently reported in the wild, successful exploitation could lead to unauthorized file creation, potentially compromising system integrity. The CVSS 4.0 score is 6.8, reflecting moderate impact and exploitability. European organizations using Samsung Mobile devices, especially those with sensitive data or critical infrastructure, should prioritize patching once updates are available. Countries with high Samsung device penetration and strategic technology sectors are more likely to be affected. Mitigation involves applying the February 2026 security update promptly, restricting local privileged access, and monitoring for suspicious file creation activities.
CVE-2026-20981 is a medium severity vulnerability in Samsung Mobile devices caused by improper input validation in the FacAtFunction component prior to the SMR February 2026 Release 1. This flaw allows a privileged physical attacker to execute arbitrary commands with system-level privileges. Exploitation requires physical access and privileged status, with no user interaction needed. The vulnerability impacts confidentiality, integrity, and availability due to the potential for full system compromise. No known exploits are currently in the wild, and no patches have been linked yet. European organizations using Samsung Mobile devices could be at risk, especially in countries with high Samsung market penetration and critical infrastructure relying on these devices. Mitigation involves restricting physical access, monitoring for unusual system commands, and promptly applying Samsung's security updates once released. Countries like Germany, the UK, France, Italy, and Spain are most likely affected due to their large Samsung user bases and strategic importance. The vulnerability's medium severity reflects the balance between high impact and the requirement for physical privileged access.
CVE-2026-20980 is a high-severity vulnerability affecting Samsung Mobile devices due to improper input validation in the PACM component prior to the SMR Feb-2026 Release 1. This flaw allows a physical attacker to execute arbitrary commands on the device without requiring authentication or user interaction. The vulnerability has a CVSS 4.0 score of 7.0, reflecting its significant impact on confidentiality, integrity, and availability. Although no known exploits are currently reported in the wild, the ease of exploitation and the critical nature of mobile devices make this a serious threat. European organizations using Samsung Mobile devices, especially those with sensitive data or critical communications, could face risks of device compromise and data breaches. Mitigation requires timely application of Samsung’s security updates once available, physical device security controls, and monitoring for unusual device behavior. Countries with high Samsung mobile market penetration and strategic importance in technology sectors, such as Germany, the UK, France, and Italy, are most likely to be affected. Defenders should prioritize patch management and physical security to reduce exposure to this vulnerability.
CVE-2026-20978 is a medium severity vulnerability affecting Samsung Mobile Devices, specifically in the KnoxGuardManager component prior to the SMR Feb-2026 Release 1. It involves improper authorization that allows local attackers with limited privileges to bypass the persistence configuration of the application. Exploitation does not require user interaction but does require some level of local privilege. The vulnerability impacts the integrity and availability of the KnoxGuardManager's persistence mechanisms, potentially allowing attackers to maintain unauthorized changes or evade security controls. No known exploits are currently reported in the wild. European organizations using Samsung Mobile Devices with KnoxGuardManager should prioritize patching once updates are available. Countries with high Samsung device penetration and critical infrastructure relying on mobile security features are most at risk. Mitigation involves applying vendor patches promptly and restricting local access to trusted users only.
CVE-2026-20977 is a medium severity vulnerability affecting Samsung Mobile Devices involving improper access control in the Emergency Sharing feature prior to the SMR February 2026 Release 1. This flaw allows local attackers to interrupt the functioning of Emergency Sharing without requiring authentication or user interaction. The vulnerability does not impact confidentiality, integrity, or availability beyond the Emergency Sharing service but can disrupt critical emergency communication capabilities. Exploitation requires local access to the device, limiting the attack surface to scenarios where an attacker has physical or local access. No known exploits are currently reported in the wild. European organizations using Samsung Mobile Devices, especially in sectors relying on emergency communication features, should prioritize updating devices once patches are available. Countries with high Samsung mobile market penetration and critical emergency response infrastructure are most likely to be affected. Mitigation involves applying the forthcoming SMR February 2026 Release 1 update and restricting local device access to trusted users. Overall, the vulnerability poses a medium risk due to its limited scope and local attack vector but could impact emergency response reliability if exploited.
CVE-2026-20976 is a medium severity vulnerability in Samsung Mobile's Galaxy Store prior to version 4.6.02, caused by improper input validation (CWE-20). It allows a local attacker to execute arbitrary scripts without requiring user interaction or privileges. The vulnerability has a CVSS 4.0 base score of 5.1, indicating moderate risk. No known exploits are currently reported in the wild. The flaw affects the Galaxy Store app on Samsung mobile devices, potentially enabling script execution that could lead to local data manipulation or further attacks. European organizations using Samsung devices with the vulnerable Galaxy Store version may face risks, especially those with sensitive mobile endpoints.
CVE-2026-20975 is a low-severity vulnerability in Samsung Cloud prior to version 5.6.11, caused by improper handling of insufficient permissions. This flaw allows local attackers to access specific files via arbitrary paths without requiring authentication or user interaction. The vulnerability stems from CWE-280, indicating improper privilege checks. Exploitation requires local access but can lead to unauthorized file disclosure. No known exploits are currently reported in the wild. The impact on confidentiality is limited, with no effect on integrity or availability. European organizations using Samsung Cloud on mobile devices could be affected, especially where Samsung devices have significant market share. Mitigation involves updating Samsung Cloud to version 5.
CVE-2026-20974 is a medium-severity vulnerability affecting Samsung Mobile devices due to improper input validation related to network restrictions. This flaw allows a physical attacker to bypass the Carrier Relock feature, which is intended to restrict device use to specific carriers. The vulnerability requires physical access but no authentication or user interaction, and it does not impact confidentiality or availability directly but compromises device integrity. There are no known exploits in the wild, and no patches have been linked yet. European organizations using Samsung Mobile devices could face risks of unauthorized carrier unlocking, potentially leading to unauthorized network access or device misuse. Mitigation involves monitoring for firmware updates from Samsung and restricting physical access to devices. Countries with high Samsung device penetration and significant mobile carrier infrastructure, such as Germany, France, the UK, Italy, and Spain, are most likely to be affected. Given the medium CVSS score of 5.2, the threat is moderate but should be addressed proactively to prevent exploitation.
CVE-2026-20973 is a medium-severity out-of-bounds read vulnerability in Samsung Mobile Devices affecting the libimagecodec.quram.so component prior to the SMR January 2026 Release 1. This flaw allows a remote attacker to read memory outside the intended bounds without requiring authentication or user interaction. The vulnerability impacts confidentiality but does not affect integrity or availability. Exploitation requires network access but is considered low complexity. No known exploits are currently in the wild, and no patches have been linked yet. European organizations using Samsung mobile devices could face data leakage risks if targeted. Mitigation involves timely application of Samsung’s security updates once available and restricting network exposure of vulnerable devices. Countries with high Samsung mobile market penetration and critical infrastructure reliance on mobile communications are most at risk.
CVE-2026-20972 is a medium severity vulnerability affecting Samsung Mobile devices, caused by improper export of Android application components in the UwbTest app prior to the SMR Jan-2026 Release 1. This flaw allows local attackers with limited privileges to enable Ultra-Wideband (UWB) functionality without user interaction or elevated authentication. The vulnerability arises from CWE-926, which involves improper export of application components, potentially exposing sensitive device capabilities. Although no known exploits are currently reported in the wild, the vulnerability could be leveraged to manipulate UWB features, possibly impacting device confidentiality or integrity. The CVSS score of 4.8 reflects a moderate risk due to the local attack vector and required privileges. European organizations using Samsung Mobile devices with affected firmware versions should be aware of this issue and apply vendor updates once available. Mitigation involves restricting local access, monitoring device behavior, and applying security patches promptly. Countries with high Samsung Mobile market penetration and strategic use of UWB technology, such as Germany, France, and the UK, are most likely to be impacted.
CVE-2026-20971 is a use-after-free vulnerability in the PROCA driver of Samsung Mobile Devices prior to the SMR January 2026 Release 1. This vulnerability allows local attackers with low privileges to potentially execute arbitrary code on affected devices. The issue is classified under CWE-416 and has a CVSS 4.0 base score of 7.3, indicating high severity. No specific affected versions are provided, and no patch or remediation details are currently available from the vendor. There are no known exploits in the wild at this time.
CVE-2026-20969 is a low-severity vulnerability in Samsung Mobile Devices caused by improper input validation in the SecSettings component prior to the SMR Jan-2026 Release 1. This flaw allows a local attacker with limited privileges to access files with system-level privileges. Exploitation requires user interaction but does not require network access, making remote exploitation infeasible. The vulnerability impacts confidentiality by potentially exposing sensitive system files but does not affect integrity or availability. No known exploits are currently in the wild. European organizations using Samsung Mobile Devices could be affected, especially in countries with high Samsung market penetration. Mitigation involves applying the January 2026 security release from Samsung once available and restricting local access to trusted users. Given the low CVSS score (2.3) and the requirement for local access and user interaction, the overall risk is low but should not be ignored in sensitive environments.
CVE-2025-58488 is a medium severity vulnerability in Samsung Mobile's SmartTouchCall application prior to version 1.0.1.1. It involves improper verification of the source of a communication channel, which can allow remote attackers to access sensitive information. Exploitation requires user interaction and high privileges. There is no confirmed patch or official fix information available at this time.
CVE-2025-58487 is an improper authorization vulnerability in Samsung Account versions prior to 15.5.01.1. It allows a local attacker to launch arbitrary activities with Samsung Account privileges. The vulnerability does not impact confidentiality or integrity but may affect availability. The CVSS score is 4.0, indicating medium severity. No known exploits are reported in the wild. No patch or remediation details are currently provided by the vendor.
CVE-2025-58486 is a medium severity vulnerability in Samsung Account prior to version 15.5.01.1 caused by improper input validation. This flaw allows a local attacker to execute arbitrary scripts. The vulnerability has a CVSS 3.1 base score of 4.0, indicating limited impact primarily on confidentiality with no impact on integrity or availability. No known exploits are reported in the wild. There is no explicit patch or remediation information provided, and the affected versions are not specified.
