Threats Tagged 'cve-2026-20988'

CVE-2026-20988 is a medium-severity vulnerability affecting Samsung Mobile devices prior to the SMR March 2026 Release 1. It involves improper verification of intent by a broadcast receiver in the Settings app, allowing a local attacker with limited privileges to launch arbitrary activities with elevated Settings privileges. Exploitation requires user interaction and local access, meaning the attacker must trick the user into triggering the malicious intent. The vulnerability stems from CWE-925, indicating improper verification of intent, which can lead to privilege escalation within the device. No known exploits are currently reported in the wild. The CVSS 4.0 base score is 6.8, reflecting moderate impact on confidentiality and integrity with limited attack vector and user interaction required. Organizations using Samsung Mobile devices should prioritize patching once updates are available and educate users to avoid suspicious prompts. This vulnerability primarily affects countries with high Samsung mobile device penetration and significant mobile user bases.

MediumVulnerabilityUnited StatesSouth KoreaIndia+10#cve#cve-2026-20988#cwe-925