# cve.now: Samsung Mobile

The newest entries naming Samsung Mobile as an affected vendor (up to 200), of 1,419 in all, 13 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-21157](https://cve.now/CVE-2026-21157.md): Improper input validation in Bixby prior to version 4.0.85.6 allows privileged local attackers to launch arbitrary activity. (CVSS 8.3)
- [CVE-2026-21139](https://cve.now/CVE-2026-21139.md): Improper access control in Samsung Continuity Service for windows prior to version 4.6.1217.0 allows adjacent attackers to manipulate the co (CVSS 7.3)
- [CVE-2026-21138](https://cve.now/CVE-2026-21138.md): Insufficient verification of data authenticity in Smart Switch prior to version 3.7.73 allows physical attackers to install arbitrary applic (CVSS 6.9)
- [CVE-2026-21137](https://cve.now/CVE-2026-21137.md): Path traversal in Smart Switch prior to version 3.7.73 allows physical attackers to access files with Smart Switch privilege. (CVSS 5.1)
- [CVE-2026-21136](https://cve.now/CVE-2026-21136.md): Improper authorization in Smart Switch prior to version 3.7.73 allows physical attackers to invoke application restore process. (CVSS 6.8)
- [CVE-2026-21135](https://cve.now/CVE-2026-21135.md): Improper access control in Samsung Internet prior to version 30.0.5.6 allows local attackers to access sensitive information. (CVSS 5.9)
- [CVE-2026-21134](https://cve.now/CVE-2026-21134.md): Improper authentication in Samsung Flow prior to version 4.9.22.4 allows adjacent attackers to access sensitive information. (CVSS 6.1)
- [CVE-2026-21133](https://cve.now/CVE-2026-21133.md): Path traversal in Samsung Flow prior to version 4.9.22.1 allows local attackers to access clipboard data. (CVSS 5.1)
- [CVE-2026-21132](https://cve.now/CVE-2026-21132.md): Improper input validation in Samsung Internet prior to version 30.0.5.24 allows remote attackers to inject arbitrary script. (CVSS 6.0)
- [CVE-2026-21131](https://cve.now/CVE-2026-21131.md): Incorrect default permission in Samsung Flow prior to version 4.9.22.4 allows local attackers to launch an arbitrary activity with Samsung F (CVSS 2.1)
- [CVE-2026-21130](https://cve.now/CVE-2026-21130.md): Improper input validation in CreditCardRetrieveActivity of Samsung Checkout prior to version 5.1.03.1 allows local attackers to launch an ar (CVSS 5.1)
- [CVE-2026-21129](https://cve.now/CVE-2026-21129.md): Improper input validation in GuestCreditCardRegisterActivity of Samsung Checkout prior to version 5.1.03.1 allows local attackers to launch (CVSS 5.1)
- [CVE-2026-21128](https://cve.now/CVE-2026-21128.md): Improper input validation in CreditCardRegisterActivity of Samsung Checkout prior to version 5.1.03.1 allows local attackers to launch arbit (CVSS 5.1)
- [CVE-2026-21127](https://cve.now/CVE-2026-21127.md): Improper export of android application components in Samsung Account prior to version 15.7.01.1 allows local attackers to access sensitive d (CVSS 6.9)
- [CVE-2026-21126](https://cve.now/CVE-2026-21126.md): Improper input validation in getting cover image in libsimba.heifdec.media.samsung.so prior to SMR Oct-2026 Release 1 allows local attackers (CVSS 6.9)
- [CVE-2026-21125](https://cve.now/CVE-2026-21125.md): Improper input validation in parsing sheifd in libsimba.heifdec.media.samsung.so prior to SMR Oct-2026 Release 1 allows local attackers to p (CVSS 8.6)
- [CVE-2026-21124](https://cve.now/CVE-2026-21124.md): Improper input validation in getting cover image in libsimba.heifdec.media.samsung.so prior to SMR Oct-2026 Release 1 allows local attackers (CVSS 8.6)
- [CVE-2026-21123](https://cve.now/CVE-2026-21123.md): Improper privilege management in Locksettings prior to SMR Oct-2026 Release 1 allows local privileged attackers with root privilege to acces (CVSS 6.7)
- [CVE-2026-21122](https://cve.now/CVE-2026-21122.md): Out-of-bounds write in libsamsungtts.so prior to SMR Oct-2026 Release 1 allows local attackers to execute arbitrary code. (CVSS 7.0)
- [CVE-2026-21121](https://cve.now/CVE-2026-21121.md): Improper handling of insufficient permission in CmcCore prior to SMR Oct-2026 Release 1 allows local attackers to use the privileged APIs. (CVSS 6.9)
- [CVE-2026-21120](https://cve.now/CVE-2026-21120.md): Use after free in WSM service prior to SMR Oct-2026 Release 1 allows local attackers to potentially execute arbitrary code with system privi (CVSS 8.9)
- [CVE-2026-21119](https://cve.now/CVE-2026-21119.md): Out-of-bounds read and write in lib\_sag\_ai\_sound\_sep\_v2.00.so prior to SMR Oct-2026 Release 1 allows local attackers to read and write out-o (CVSS 4.8)
- [CVE-2026-21118](https://cve.now/CVE-2026-21118.md): Improper access control in DownloadProvider prior to SMR Oct-2026 Release 1 allows local attackers to access files in scoped storage. (CVSS 6.9)
- [CVE-2026-21117](https://cve.now/CVE-2026-21117.md): Improper access control in CocktailBarService prior to SMR Oct-2026 Release 1 allows local attackers to access sensitive information. (CVSS 5.1)
- [CVE-2026-21116](https://cve.now/CVE-2026-21116.md): Out-of-bounds write in libsmkvextractor.so prior to SMR Oct-2026 Release 1 allows local attackers to write out-of-bounds memory. (CVSS 5.1)
- [CVE-2026-21115](https://cve.now/CVE-2026-21115.md): Out-of-bounds write in libcodec2-sec-flacdec.so prior to SMR Oct-2026 Release 1 allows local attackers to write out-of-bounds memory. (CVSS 5.1)
- [CVE-2026-21114](https://cve.now/CVE-2026-21114.md): Out-of-bounds write in libsmkvextractor.so prior to SMR Oct-2026 Release 1 allows local attackers to execute arbitrary code. (CVSS 7.0)
- [CVE-2026-21140](https://cve.now/CVE-2026-21140.md): Improper access control in ManagedProvisioning prior to SMR Sep-2026 Release 1 allows local attackers to install arbitrary applications. (CVSS 6.9)
- [CVE-2026-21113](https://cve.now/CVE-2026-21113.md): Improper export of android application components in Visual Voicemail prior to version 20.1.00.05 allows local attackers to initiate call wi (CVSS 4.8)
- [CVE-2026-21112](https://cve.now/CVE-2026-21112.md): Improper input validation in Samsung Tips prior to Android 17 allows local attackers to launch arbitrary activity with Samsung Tips privileg (CVSS 5.1)
- [CVE-2026-21111](https://cve.now/CVE-2026-21111.md): Out-of-bounds write in libsthmbc.so prior to One UI 8.5 allows local attackers to write out-of-bounds memory. (CVSS 6.9)
- [CVE-2026-21110](https://cve.now/CVE-2026-21110.md): Out-of-bounds write in libsavscmn.so prior to One UI 8.5 allows local attackers to execute arbitrary code. (CVSS 6.9)
- [CVE-2026-21109](https://cve.now/CVE-2026-21109.md): Improper access control in Watch Plugin prior to Android Watch 17 allows local attackers to access sensitive information. (CVSS 2.1)
- [CVE-2026-21108](https://cve.now/CVE-2026-21108.md): Improper export of android application components in Bixby Touch prior to version 4.3.01.17 allows local attackers to access sensitive infor (CVSS 6.9)
- [CVE-2026-21107](https://cve.now/CVE-2026-21107.md): Out-of-bounds write in Samsung Notes prior to version 4.4.45.5 allows local attackers to write out-of-bounds memory. (CVSS 6.9)
- [CVE-2026-21106](https://cve.now/CVE-2026-21106.md): Improper verification of intent by broadcast receiver in Samsung Cloud Assistant prior to version 9.0.5 allows local attackers to disable en (CVSS 5.1)
- [CVE-2026-21105](https://cve.now/CVE-2026-21105.md): Improper access control in Collection prior to version 1.0.1.14 in Android 15 and 2.0.02.7 in Android 16 allows local attackers to access se (CVSS 5.9)
- [CVE-2026-21104](https://cve.now/CVE-2026-21104.md): Heap-based buffer overflow in KnoxVault trustlet prior to SMR Sep-2026 Release 1 allows local privileged attackers to execute arbitrary code (CVSS 7.1)
- [CVE-2026-21103](https://cve.now/CVE-2026-21103.md): Path traversal in GalaxyDiagnostics prior to SMR Sep-2026 Release 1 allows physical attackers to access files with system privilege. (CVSS 6.8)
- [CVE-2026-21102](https://cve.now/CVE-2026-21102.md): Use after free in DualDAR prior to SMR Sep-2026 Release 1 allows local privileged attackers to execute arbitrary code with root privilege. (CVSS 9.3)
- [CVE-2026-21101](https://cve.now/CVE-2026-21101.md): Improper input validation in DualDAR driver prior to SMR Sep-2026 Release 1 allows local privileged attackers to potentially execute arbitra (CVSS 8.4)
- [CVE-2026-21100](https://cve.now/CVE-2026-21100.md): Improper access control in SystemUI prior to SMR Sep-2026 Release 1 allows local attackers to launch arbitrary activity. (CVSS 6.9)
- [CVE-2026-21099](https://cve.now/CVE-2026-21099.md): Improper access control in SettingsProvider prior to SMR Sep-2026 Release 1 allows local attackers to access sensitive information. (CVSS 5.1)
- [CVE-2026-21098](https://cve.now/CVE-2026-21098.md): Improper access control in Link to Windows prior to SMR Sep-2026 Release 1 allows local attackers to establish a connection with the PC with (CVSS 6.9)
- [CVE-2026-21097](https://cve.now/CVE-2026-21097.md): Improper authentication in ActivityTaskManagerService prior to SMR Sep-2026 Release 1 allows local privileged attackers to launch arbitrary (CVSS 4.6)
- [CVE-2026-21096](https://cve.now/CVE-2026-21096.md): Heap-based buffer overflow in JPEG decoder of libimagecodec.quram.so prior to SMR Sep-2026 Release 1 allows remote attackers to execute arbi (CVSS 9.2)
- [CVE-2026-21095](https://cve.now/CVE-2026-21095.md): Heap-based buffer overflow in DNG decoder of libimagecodec.quram.so prior to SMR Sep-2026 Release 1 allows remote attackers to execute arbit (CVSS 9.2)
- [CVE-2026-21094](https://cve.now/CVE-2026-21094.md): Improper input validation in wpa\_supplicant prior to SMR Sep-2026 Release 1 allows adjacent attackers to write out-of-bounds memory. (CVSS 6.1)
- [CVE-2026-21093](https://cve.now/CVE-2026-21093.md): Stack-based buffer overflow in PROCA trustlet prior to SMR Sep-2026 Release 1 allows local privileged attackers to write out-of-bounds memor (CVSS 5.6)
- [CVE-2026-21092](https://cve.now/CVE-2026-21092.md): Path traversal in ImsService prior to SMR Sep-2026 Release 1 allows remote attackers to create image files with system server privilege. (CVSS 8.8)
- [CVE-2026-21091](https://cve.now/CVE-2026-21091.md): Out-of-bounds write in libcodec2secevrcdec.so prior to SMR Sep-2026 Release 1 allows local attackers to write out-of-bounds memory. (CVSS 4.4)
- [CVE-2026-21090](https://cve.now/CVE-2026-21090.md): Out-of-bounds write in libsaviextractor.so prior to SMR Sep-2026 Release 1 allows local attackers to write out-of-bounds memory. (CVSS 4.4)
- [CVE-2026-21089](https://cve.now/CVE-2026-21089.md): Improper input validation in removing style tag in libsubextractor.so prior to SMR Sep-2026 Release 1 allows local attackers to write out-of (CVSS 6.9)
- [CVE-2026-21088](https://cve.now/CVE-2026-21088.md): Improper input validation in loading a subtitle frame in libsubextractor.so prior to SMR Sep-2026 Release 1 allows local attackers to write (CVSS 6.9)
- [CVE-2026-21087](https://cve.now/CVE-2026-21087.md): Out-of-bounds write in libmdnie.so prior to SMR Sep-2026 Release 1 allows local attackers to execute arbitrary code with system server privi (CVSS 8.6)
- [CVE-2026-21086](https://cve.now/CVE-2026-21086.md): Improper authorization in ProxyHandler prior to SMR Aug-2026 Release 1 allows local attackers to access proxy configuration. (CVSS 4.8)
- [CVE-2026-21085](https://cve.now/CVE-2026-21085.md): Out-of-bounds write in Keymaster trustlet prior to SMR Sep-2026 Release 1 allows local privileged attackers to write out-of-bounds memory. (CVSS 8.4)
- [CVE-2026-21084](https://cve.now/CVE-2026-21084.md): Improper access control in SmartThings prior to version 1.8.47.24 allows local attackers to access sensitive information. (CVSS 6.9)
- [CVE-2026-21083](https://cve.now/CVE-2026-21083.md): Improper input validation in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to access sensitive data. (CVSS 6.8)
- [CVE-2026-21082](https://cve.now/CVE-2026-21082.md): Relative path traversal in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information. (CVSS 6.9)
- [CVE-2026-21081](https://cve.now/CVE-2026-21081.md): Improper export of android application components in SamsungPassAutofill prior to version 5.2.10.x allows local attackers to access sensitiv (CVSS 5.1)
- [CVE-2026-21080](https://cve.now/CVE-2026-21080.md): Cleartext storage of sensitive information in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to access sensitive data. (CVSS 6.9)
- [CVE-2026-21079](https://cve.now/CVE-2026-21079.md): Missing encryption of sensitive data in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to intercept transmitted data. (CVSS 7.0)
- [CVE-2026-21078](https://cve.now/CVE-2026-21078.md): Insufficient verification of data authenticity in Smart Switch trouble scanning mode prior to version 3.7.72.6 allows adjacent attackers to (CVSS 4.7)
- [CVE-2026-21077](https://cve.now/CVE-2026-21077.md): Incorrect authorization in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information. (CVSS 6.9)
- [CVE-2026-21076](https://cve.now/CVE-2026-21076.md): Incorrect authorization in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information. (CVSS 6.9)
- [CVE-2026-21075](https://cve.now/CVE-2026-21075.md): Improper authorization in handler for custom URL scheme in My Galaxy prior to version 6.3 allows remote attackers to access sensitive inform (CVSS 5.3)
- [CVE-2026-21074](https://cve.now/CVE-2026-21074.md): Incorrect default permissions in Bixby prior to version 4.0.86.0 allows local attackers to execute arbitrary commands with Bixby privilege. (CVSS 7.2)
- [CVE-2026-21073](https://cve.now/CVE-2026-21073.md): Improper input validation in Galaxy Themes prior to SMR Aug-2026 Release 1 allows physical attackers to launch arbitrary activity. (CVSS 5.2)
- [CVE-2026-21072](https://cve.now/CVE-2026-21072.md): Improper input validation in VC1 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory. (CVSS 5.1)
- [CVE-2026-21071](https://cve.now/CVE-2026-21071.md): Improper input validation in MPEG4 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memor (CVSS 5.1)
- [CVE-2026-21070](https://cve.now/CVE-2026-21070.md): Improper input validation in Samsung Message prior to SMR Aug-2026 Release 1 allows physical attackers to access sensitive information. (CVSS 5.1)
- [CVE-2026-21069](https://cve.now/CVE-2026-21069.md): Incorrect conversion between numeric types in VC1 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local attackers to write out- (CVSS 5.1)
- [CVE-2026-21068](https://cve.now/CVE-2026-21068.md): Stack-based buffer overflow in libril\_sem.so prior to SMR Aug-2026 Release 1 allows privileged local attackers to execute arbitrary code. (CVSS 8.4)
- [CVE-2026-21067](https://cve.now/CVE-2026-21067.md): Improper input validation in libsmsd.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory. (CVSS 5.1)
- [CVE-2026-21066](https://cve.now/CVE-2026-21066.md): Improper input validation in libcodec2\_sec\_flacdec.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory. (CVSS 5.1)
- [CVE-2026-21065](https://cve.now/CVE-2026-21065.md): Out-of-bounds write in libcodec2secqcelpdec.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory. (CVSS 4.4)
- [CVE-2026-21064](https://cve.now/CVE-2026-21064.md): Improper access control in Weaver prior to SMR Aug-2026 Release 1 allows local attackers to cause device inoperability. (CVSS 7.0)
- [CVE-2026-21063](https://cve.now/CVE-2026-21063.md): Improper export of android application components in AppLock prior to SMR Aug-2026 Release 1 allows physical attackers to bypass app lock fu (CVSS 6.8)
- [CVE-2026-21062](https://cve.now/CVE-2026-21062.md): Authorization bypass in SemClipboardService prior to SMR Aug-2026 Release 1 allows local attackers to access clipboard data. (CVSS 4.8)
- [CVE-2026-21061](https://cve.now/CVE-2026-21061.md): Improper input validation in Samsung Dialer prior to SMR Aug-2026 Release 1 allows remote attackers to access SIM related functions. (CVSS 6.0)
- [CVE-2026-21060](https://cve.now/CVE-2026-21060.md): Improper input validation in Samsung Contacts prior to SMR Aug-2026 Release 1 allows physical attackers to access data across multiple user (CVSS 6.7)
- [CVE-2026-21059](https://cve.now/CVE-2026-21059.md): Improper export of android application components in Samsung Contacts prior to SMR Aug-2026 Release 1 allows local attackers to delete file (CVSS 6.9)
- [CVE-2026-21058](https://cve.now/CVE-2026-21058.md): Improper input validation in Samsung Contacts prior to SMR Aug-2026 Release 1 allows local attackers to delete file with Samsung Contacts' p (CVSS 6.9)
- [CVE-2026-21047](https://cve.now/CVE-2026-21047.md): Out-of-bounds write in ImsService prior to SMR Jul-2026 Release 1 allows remote attackers to potentially execute arbitrary code. (CVSS 8.3)
- [CVE-2026-21057](https://cve.now/CVE-2026-21057.md): Improper input validation in Samsung Pass prior to version 5.2.10.3 allows local privileged attackers to write out-of-bounds memory. (CVSS 6.8)
- [CVE-2026-21056](https://cve.now/CVE-2026-21056.md): Improper authorization in Samsung Health prior to version 7.00.0.107 allows local attackers to access connected device information. (CVSS 4.8)
- [CVE-2026-21055](https://cve.now/CVE-2026-21055.md): Improper export of android application components in Bixby prior to version 4.0.70.8 allows local attackers to execute arbitrary commands wi (CVSS 8.5)
- [CVE-2026-21054](https://cve.now/CVE-2026-21054.md): Improper export of android application components in InputSharing prior to version 2.7.01.4 allows local attackers to access sharing data. (CVSS 6.9)
- [CVE-2026-21053](https://cve.now/CVE-2026-21053.md): Improper input validation in Samsung Email prior to version 6.2.13.1 allows local attackers to create arbitrary files within the application (CVSS 5.1)
- [CVE-2026-21052](https://cve.now/CVE-2026-21052.md): Path traversal in SemClipboardService prior to SMR Jul-2026 Release 1 allows local privileged attackers to access files with system… (CVSS 6.8)
- [CVE-2026-21051](https://cve.now/CVE-2026-21051.md): Incorrect default permissions in WLAN security prior to SMR Jul-2026 Release 1 allows local attackers to configure TencentWifiSecurity setti (CVSS 5.1)
- [CVE-2026-21050](https://cve.now/CVE-2026-21050.md): Improper access control in SmartThingsKit prior to SMR Jul-2026 Release 1 allows local attackers to access sensitive information. (CVSS 5.1)
- [CVE-2026-21049](https://cve.now/CVE-2026-21049.md): Out-of-bounds write in libpadm.so library prior to SMR Jul-2026 Release 1 allows local attackers to execute arbitrary code. (CVSS 8.4)
- [CVE-2026-21048](https://cve.now/CVE-2026-21048.md): Out-of-bounds write in parsing DNG format in libimagecodec.media.quram.so prior to SMR Jul-2026 Release 1 allows remote attackers to write o (CVSS 8.4)
- [CVE-2026-21046](https://cve.now/CVE-2026-21046.md): Time-of-check time-of-use race condition in fabricKeymaster trustlet prior to SMR Jul-2026 Release 1 allows local privileged attackers to ex (CVSS 8.4)
- [CVE-2026-21045](https://cve.now/CVE-2026-21045.md): Out-of-bounds write in parsing TIFF format in libimagecodec.media.quram.so prior to SMR Jul-2026 Release 1 allows remote attackers to write (CVSS 8.4)
- [CVE-2026-21044](https://cve.now/CVE-2026-21044.md): Improper authorization in KnoxGuardManager prior to SMR Jul-2026 Release 1 allows local attackers to bypass the persistence configuration of (CVSS 5.8)
- [CVE-2026-21043](https://cve.now/CVE-2026-21043.md): Path traversal in Wallpaper service prior to SMR Jul-2026 Release 1 allows local privileged attackers to access files with system server pri (CVSS 6.7)
- [CVE-2026-21042](https://cve.now/CVE-2026-21042.md): Out-of-bounds write in libsavsac.so prior to SMR Jul-2026 Release 1 allows remote attackers to execute arbitrary code. (CVSS 8.7)
- [CVE-2026-21041](https://cve.now/CVE-2026-21041.md): Improper access control in SamsungSEAgentService prior to SMR Jul-2026 Release 1 allows local attackers to access sensitive information. (CVSS 6.9)
- [CVE-2026-21040](https://cve.now/CVE-2026-21040.md): Improper access control in IAFDService prior to SMR Jul-2026 Release 1 allows local privileged attackers to use the privileged APIs. (CVSS 6.9)
- [CVE-2026-21039](https://cve.now/CVE-2026-21039.md): Improper access control in Settings prior to SMR Jul-2026 Release 1 allows local attackers to configure Theft protection settings. (CVSS 6.9)
- [CVE-2026-21038](https://cve.now/CVE-2026-21038.md): Improper input validation in Samsung Android USB Driver for Windows prior to version 1.9.5.0 allows local attacker to access out-of-bounds m (CVSS 5.9)
- [CVE-2026-21037](https://cve.now/CVE-2026-21037.md): Improper input validation in Samsung Members prior to version 5.8.01.5 allows local attackers to access arbitrary URL and launch arbitrary a (CVSS 6.9)
- [CVE-2026-21036](https://cve.now/CVE-2026-21036.md): Improper authorization in Samsung Internet prior to version 30.0.0.39 allows local attackers to access sensitive information. (CVSS 6.3)
- [CVE-2026-21035](https://cve.now/CVE-2026-21035.md): Improper input validation in Samsung Plus TV prior to version 1.0.28.6 allows remote attackers to access sensitive information. (CVSS 6.5)
- [CVE-2026-21034](https://cve.now/CVE-2026-21034.md): Improper export of android application components in Samsung Auto prior to version 3.1.2.61 in Android 15 and 3.2.0.38 in Android 16 allows (CVSS 4.8)
- [CVE-2026-21033](https://cve.now/CVE-2026-21033.md): Improper export of android application components in ExpressHomeWidgetReceiver of Samsung Assistant prior to version 9.3.14 allows local att (CVSS 6.9)
- [CVE-2026-21032](https://cve.now/CVE-2026-21032.md): Improper export of android application components in SmartHomeWidgetReceiver of Samsung Assistant prior to version 9.3.14 allows local attac (CVSS 6.9)
- [CVE-2026-21031](https://cve.now/CVE-2026-21031.md): Improper authorization in AppBlock prior to SMR Jun-2026 Release 1 allows local attacker to launch arbitrary activity. (CVSS 5.2)
- [CVE-2026-21030](https://cve.now/CVE-2026-21030.md): Improper access control in MediaTek Audio HAL prior to SMR Jun-2026 Release 1 allows local attackers to trigger privileged functions. (CVSS 6.4)
- [CVE-2026-21029](https://cve.now/CVE-2026-21029.md): Improper export of android application components in Galaxy Editing Service prior to SMR Jun-2026 Release 1 allows local attacker to execute (CVSS 6.8)
- [CVE-2026-21028](https://cve.now/CVE-2026-21028.md): Improper access control in AuditLogService prior to SMR Jun-2026 Release 1 allows local attackers to access sensitive information. (CVSS 5.1)
- [CVE-2026-21027](https://cve.now/CVE-2026-21027.md): Improper export of android application components in ImsSettings prior to SMR Jun-2026 Release 1 allows local attackers to trigger logging f (CVSS 4.8)
- [CVE-2026-21026](https://cve.now/CVE-2026-21026.md): Improper export of android application components in SpriteWallpaper prior to SMR Jun-2026 Release 1 allows local attackers to access to sen (CVSS 6.4)
- [CVE-2026-21025](https://cve.now/CVE-2026-21025.md): Incorrect privilege assignment in Telephony prior to SMR Jun-2026 Release 1 allows local attackers to access sensitive information. (CVSS 6.9)
- [CVE-2026-21017](https://cve.now/CVE-2026-21017.md): Improper handling of insufficient privileges in SecTelephonyProvider prior to SMR Jun-2026 Release 1 allows local attackers to access privil (CVSS 4.6)
- [CVE-2026-21024](https://cve.now/CVE-2026-21024.md): Improper privilege management in Samsung System Support Service prior to version 8.0.8.0 allows local attackers to trigger privileged functi (CVSS 6.3)
- [CVE-2026-21022](https://cve.now/CVE-2026-21022.md): Improper handling of insufficient permissions in Routines prior to SMR May-2026 Release 1 allows local attackers to access sensitive informa (CVSS 6.9)
- [CVE-2026-21021](https://cve.now/CVE-2026-21021.md): Improper input validation in Routines prior to SMR May-2026 Release 1 allows physical attackers to launch privileged activity. (CVSS 5.1)
- [CVE-2026-21020](https://cve.now/CVE-2026-21020.md): Improper export of android application components in OmaCP prior to SMR May-2026 Release 1 allows local attackers to trigger privileged func (CVSS 5.1)
- [CVE-2026-21019](https://cve.now/CVE-2026-21019.md): Improper input validation in FacAtFunction in Galaxy Watch prior to SMR May-2026 Release 1 allows local attacker to execute arbitrary code w (CVSS 8.9)
- [CVE-2026-21018](https://cve.now/CVE-2026-21018.md): Out-of-bounds write in SveService prior to SMR May-2026 Release 1 allows local privileged attackers to execute arbitrary code. (CVSS 6.8)
- [CVE-2026-21016](https://cve.now/CVE-2026-21016.md): Incorrect privilege assignment in LocationManager prior to SMR May-2026 Release 1 allows local attackers to access sensitive information. (CVSS 5.1)
- [CVE-2026-21015](https://cve.now/CVE-2026-21015.md): Incorrect default permissions in FactoryCamera prior to SMR May-2026 Release 1 allows local attacker to access unique identifier. (CVSS 6.8)
- [CVE-2026-21023](https://cve.now/CVE-2026-21023.md): Insufficient verification of data authenticity in PackageManagerService prior to SMR Mar-2026 Release 1 allows local attackers to modify the (CVSS 6.9)
- [CVE-2026-21010](https://cve.now/CVE-2026-21010.md): Improper input validation in Retail Mode prior to SMR Apr-2026 Release 1 allows local attackers to trigger privileged functions. (CVSS 6.6)
- [CVE-2026-21008](https://cve.now/CVE-2026-21008.md): Exposure of sensitive information in S Share prior to SMR Apr-2026 Release 1 allows adjacent attacker to access sensitive information. (CVSS 5.1)
- [CVE-2026-21014](https://cve.now/CVE-2026-21014.md): Improper access control in Samsung Camera prior to version 16.5.00.28 allows local attacker to access location data. (CVSS 5.1)
- [CVE-2026-21013](https://cve.now/CVE-2026-21013.md): Incorrect default permission in Galaxy Wearable prior to version 2.2.68.26 allows local attackers to access sensitive information. (CVSS 6.9)
- [CVE-2026-21012](https://cve.now/CVE-2026-21012.md): External control of file name in AODManager prior to SMR Apr-2026 Release 1 allows privileged local attacker to create file with system priv (CVSS 6.8)
- [CVE-2026-21011](https://cve.now/CVE-2026-21011.md): Incorrect privilege assignment in Bluetooth in Maintenance mode prior to SMR Apr-2026 Release 1 allows physical attackers to bypass Extend U (CVSS 5.4)
- [CVE-2026-21009](https://cve.now/CVE-2026-21009.md): Improper check for exceptional conditions in Recents prior to SMR Apr-2026 Release 1 allows physical attacker to bypass App Pinning. (CVSS 4.1)
- [CVE-2026-21007](https://cve.now/CVE-2026-21007.md): Improper check for exceptional conditions in Device Care prior to SMR Apr-2026 Release 1 allows physical attackers to bypass Knox Guard. (CVSS 4.4)
- [CVE-2026-21006](https://cve.now/CVE-2026-21006.md): Improper access control in Samsung DeX prior to SMR Apr-2026 Release 1 allows physical attackers to access to hidden notification contents. (CVSS 4.7)
- [CVE-2026-21003](https://cve.now/CVE-2026-21003.md): Improper input validation in data related to network restrictions prior to SMR Apr-2026 Release 1 allows physical attackers to bypass the re (CVSS 5.2)
- [CVE-2026-21005](https://cve.now/CVE-2026-21005.md): Path traversal in Smart Switch prior to version 3.7.69.15 allows adjacent attackers to overwrite arbitrary files with Smart Switch privilege (CVSS 7.1)
- [CVE-2026-21004](https://cve.now/CVE-2026-21004.md): Improper authentication in Smart Switch prior to version 3.7.69.15 allows adjacent attackers to trigger a denial of service. (CVSS 6.9)
- [CVE-2026-21002](https://cve.now/CVE-2026-21002.md): Improper verification of cryptographic signature in Galaxy Store prior to version 4.6.03.8 allows local attacker to install arbitrary applic (CVSS 5.9)
- [CVE-2026-21001](https://cve.now/CVE-2026-21001.md): Path traversal in Galaxy Store prior to version 4.6.03.8 allows local attacker to create file with Galaxy Store privilege. (CVSS 5.9)
- [CVE-2026-21000](https://cve.now/CVE-2026-21000.md): Improper access control in Galaxy Store prior to version 4.6.03.8 allows local attacker to create file with Galaxy Store privilege. (CVSS 7.0)
- [CVE-2026-20999](https://cve.now/CVE-2026-20999.md): Authentication bypass by replay in Smart Switch prior to version 3.7.69.15 allows remote attackers to trigger privileged functions. (CVSS 7.1)
- [CVE-2026-20998](https://cve.now/CVE-2026-20998.md): Improper authentication in Smart Switch prior to version 3.7.69.15 allows remote attackers to bypass authentication. (CVSS 7.1)
- [CVE-2026-20997](https://cve.now/CVE-2026-20997.md): Improper verification of cryptographic signature in Smart Switch prior to version 3.7.69.15 allows remote attackers to potentially bypass au (CVSS 5.3)
- [CVE-2026-20996](https://cve.now/CVE-2026-20996.md): Use of a broken or risky cryptographic algorithm in Smart Switch prior to version 3.7.69.15 allows remote attackers to configure a downgrade (CVSS 7.1)
- [CVE-2026-20995](https://cve.now/CVE-2026-20995.md): Exposure of sensitive functionality to an unauthorized actor in Smart Switch prior to version 3.7.69.15 allows remote attackers to set a spe (CVSS 5.3)
- [CVE-2026-20994](https://cve.now/CVE-2026-20994.md): URL redirection in Samsung Account prior to version 15.5.01.1 allows local attackers to potentially get access token. (CVSS 6.9)
- [CVE-2026-20993](https://cve.now/CVE-2026-20993.md): Improper export of android application components in Samsung Assistant prior to version 9.3.10.7 allows local attacker to access saved infor (CVSS 4.8)
- [CVE-2026-20992](https://cve.now/CVE-2026-20992.md): Improper authorization in Settings prior to SMR Mar-2026 Release 1 allows local attacker to disable configuring the background data usage of (CVSS 4.8)
- [CVE-2026-20991](https://cve.now/CVE-2026-20991.md): Improper privilege management in ThemeManager prior to SMR Mar-2026 Release 1 allows local privileged attackers to reuse trial contents. (CVSS 6.7)
- [CVE-2026-20990](https://cve.now/CVE-2026-20990.md): Improper export of android application components in Secure Folder prior to SMR Mar-2026 Release 1 allows local attackers to launch arbitrar (CVSS 8.4)
- [CVE-2026-20989](https://cve.now/CVE-2026-20989.md): Improper verification of cryptographic signature in Font Settings prior to SMR Mar-2026 Release 1 allows physical attackers to use custom fo (CVSS 5.1)
- [CVE-2026-20988](https://cve.now/CVE-2026-20988.md): Improper verification of intent by broadcast receiver in Settings prior to SMR Mar-2026 Release 1 allows local attacker to launch arbitrary (CVSS 6.8)
- [CVE-2026-20987](https://cve.now/CVE-2026-20987.md): Improper input validation in GalaxyDiagnostics prior to version 3.5.050 allows local privileged attackers to execute privileged commands. (CVSS 8.7)
- [CVE-2026-20986](https://cve.now/CVE-2026-20986.md): Path traversal in Samsung Members prior to Chinese version 15.5.05.4 allows local attackers to overwrite data within Samsung Members. (CVSS 5.1)
- [CVE-2026-20985](https://cve.now/CVE-2026-20985.md): Improper input validation in Samsung Members prior to version 5.6.00.11 allows remote attackers to connect arbitrary URL and launch arbitrar (CVSS 7.0)
- [CVE-2026-20984](https://cve.now/CVE-2026-20984.md): Improper handling of insufficient permission in Galaxy Wearable installed on non-Samsung Device prior to version 2.2.68 allows local attacke (CVSS 5.1)
- [CVE-2026-20983](https://cve.now/CVE-2026-20983.md): Improper export of android application components in Samsung Dialer prior to SMR Feb-2026 Release 1 allows local attackers to launch arbitra (CVSS 8.4)
- [CVE-2026-20982](https://cve.now/CVE-2026-20982.md): Path traversal in ShortcutService prior to SMR Feb-2026 Release 1 allows privileged local attacker to create file with system privilege. (CVSS 6.8)
- [CVE-2026-20981](https://cve.now/CVE-2026-20981.md): Improper input validation in FacAtFunction prior to SMR Feb-2026 Release 1 allows privileged physical attacker to execute arbitrary command (CVSS 5.4)
- [CVE-2026-20980](https://cve.now/CVE-2026-20980.md): Improper input validation in PACM prior to SMR Feb-2026 Release 1 allows physical attacker to execute arbitrary commands. (CVSS 7.0)
- [CVE-2026-20979](https://cve.now/CVE-2026-20979.md): Improper privilege management in Settings prior to SMR Feb-2026 Release 1 allows local attackers to launch arbitrary activity with Settings (CVSS 8.4)
- [CVE-2026-20978](https://cve.now/CVE-2026-20978.md): Improper authorization in KnoxGuardManager prior to SMR Feb-2026 Release 1 allows local attackers to bypass the persistence configuration of (CVSS 5.8)
- [CVE-2026-20977](https://cve.now/CVE-2026-20977.md): Improper access control in Emergency Sharing prior to SMR Feb-2026 Release 1 allows local attackers to interrupt its functioning. (CVSS 6.9)
- [CVE-2026-20976](https://cve.now/CVE-2026-20976.md): Improper input validation in Galaxy Store prior to version 4.6.02 allows local attacker to execute arbitrary script. (CVSS 5.1)
- [CVE-2026-20975](https://cve.now/CVE-2026-20975.md): Improper handling of insufficient permission in Samsung Cloud prior to version 5.6.11 allows local attackers to access specific files in arb (CVSS 2.1)
- [CVE-2026-20974](https://cve.now/CVE-2026-20974.md): Improper input validation in data related to network restrictions prior to SMR Jan-2026 Release 1 allows physical attackers to bypass Carrie (CVSS 5.2)
- [CVE-2026-20973](https://cve.now/CVE-2026-20973.md): Out-of-bounds read in libimagecodec.quram.so prior to SMR Jan-2026 Release 1 allows remote attacker to access out-of-bounds memory. (CVSS 5.3)
- [CVE-2026-20972](https://cve.now/CVE-2026-20972.md): Improper Export of Android Application Components in UwbTest prior to SMR Jan-2026 Release 1 allows local attackers to enable UWB. (CVSS 4.8)
- [CVE-2026-20971](https://cve.now/CVE-2026-20971.md): Use After Free in PROCA driver prior to SMR Jan-2026 Release 1 allows local attackers to potentially execute arbitrary code. (CVSS 7.3)
- [CVE-2026-20970](https://cve.now/CVE-2026-20970.md): Improper access control in SLocation prior to SMR Jan-2026 Release 1 allows local attackers to execute the privileged APIs. (CVSS 6.8)
- [CVE-2026-20969](https://cve.now/CVE-2026-20969.md): Improper input validation in SecSettings prior to SMR Jan-2026 Release 1 allows local attacker to access file with system privilege. (CVSS 2.3)
- [CVE-2026-20968](https://cve.now/CVE-2026-20968.md): Use after free in DualDAR prior to SMR Jan-2026 Release 1 allows local privileged attackers to execute arbitrary code. (CVSS 6.7)
- [CVE-2025-58488](https://cve.now/CVE-2025-58488.md): Improper verification of source of a communication channel in SmartTouchCall prior to version 1.0.1.1 allows remote attackers to access sens (CVSS 4.5)
- [CVE-2025-58487](https://cve.now/CVE-2025-58487.md): Improper authorization in Samsung Account prior to version 15.5.01.1 allows local attacker to launch arbitrary activity with Samsung Account (CVSS 4.0)
- [CVE-2025-58486](https://cve.now/CVE-2025-58486.md): Improper input validation in Samsung Account prior to version 15.5.01.1 allows local attacker to execute arbitrary script. (CVSS 4.0)
- [CVE-2025-58485](https://cve.now/CVE-2025-58485.md): Improper input validation in Samsung Internet prior to version 29.0.0.48 allows local attackers to inject arbitrary script. (CVSS 5.5)
- [CVE-2025-58484](https://cve.now/CVE-2025-58484.md): Incorrect default permissions in Samsung Cloud Assistant prior to version 8.0.03.8 allows local attacker to access partial data in sandbox. (CVSS 4.0)
- [CVE-2025-58483](https://cve.now/CVE-2025-58483.md): Improper export of android application components in Galaxy Store for Galaxy Watch prior to version 1.0.06.29 allows local attacker to insta (CVSS 5.9)
- [CVE-2025-58482](https://cve.now/CVE-2025-58482.md): Improper access control in MPLocalService of MotionPhoto prior to version 4.1.51 allows local attackers to start privileged service. (CVSS 7.3)
- [CVE-2025-58481](https://cve.now/CVE-2025-58481.md): Improper access control in MPRemoteService of MotionPhoto prior to version 4.1.51 allows local attackers to start privileged service. (CVSS 7.3)
- [CVE-2025-58480](https://cve.now/CVE-2025-58480.md): Heap-based buffer overflow in libimagecodec.quram.so prior to SMR Dec-2025 Release 1 allows remote attackers to access out-of-bounds memory. (CVSS 4.3)
- [CVE-2025-58479](https://cve.now/CVE-2025-58479.md): Out-of-bounds read in libimagecodec.quram.so prior to SMR Dec-2025 Release 1 allows remote attackers to access out-of-bounds memory. (CVSS 4.3)
- [CVE-2025-58478](https://cve.now/CVE-2025-58478.md): Out-of-bounds write in libimagecodec.quram.so prior to SMR Dec-2025 Release 1 allows remote attackers to access out-of-bounds memory. (CVSS 4.3)
- [CVE-2025-58477](https://cve.now/CVE-2025-58477.md): Out-of-bounds write in parsing IFD tag in libimagecodec.quram.so prior to SMR Dec-2025 Release 1 allows remote attackers to access out-of-bo (CVSS 4.3)
- [CVE-2025-58476](https://cve.now/CVE-2025-58476.md): Out-of-bounds read vulnerability in bootloader prior to SMR Dec-2025 Release 1 allows physical attackers to access out-of-bounds memory. (CVSS 4.2)
- [CVE-2025-58475](https://cve.now/CVE-2025-58475.md): Improper input validation in libsec-ril.so prior to SMR Dec-2025 Release 1 allows local privileged attackers to write out-of-bounds memory. (CVSS 5.6)
- [CVE-2025-21080](https://cve.now/CVE-2025-21080.md): Improper export of android application components in Dynamic Lockscreen prior to SMR Dec-2025 Release 1 allows local attackers to access fil (CVSS 6.2)
- [CVE-2025-21072](https://cve.now/CVE-2025-21072.md): Out-of-bounds write in decoding metadata in fingerprint trustlet prior to SMR Dec-2025 Release 1 allows local privileged attackers to write (CVSS 5.7)
- [CVE-2025-21079](https://cve.now/CVE-2025-21079.md): Improper input validation in Samsung Members prior to version 5.5.01.3 allows remote attackers to connect arbitrary URL and launch arbitrary (CVSS 7.1)
- [CVE-2025-21078](https://cve.now/CVE-2025-21078.md): Use of insufficiently random value of secretKey in Smart Switch prior to version 3.7.68.6 allows adjacent attackers to access backup data fr (CVSS 8.8)
- [CVE-2025-21077](https://cve.now/CVE-2025-21077.md): Improper input validation in Samsung Email prior to version 6.2.06.0 allows local attackers to launch arbitrary activity with Samsung Email (CVSS 3.3)
- [CVE-2025-21076](https://cve.now/CVE-2025-21076.md): Improper handling of insufficient permissions or privileges in Samsung Account prior to version 15.5.00.18 allows local attackers to access (CVSS 5.5)
- [CVE-2025-21075](https://cve.now/CVE-2025-21075.md): Out-of-bounds write in libimagecodec.quram.so prior to SMR Nov-2025 Release 1 allows remote attackers to access out-of-bounds memory. (CVSS 4.3)
- [CVE-2025-21074](https://cve.now/CVE-2025-21074.md): Out-of-bounds read in libimagecodec.quram.so prior to SMR Nov-2025 Release 1 allows remote attackers to access out-of-bounds memory. (CVSS 4.3)
- [CVE-2025-21073](https://cve.now/CVE-2025-21073.md): Insecure default configuration in USB connection mode prior to SMR Nov-2025 Release 1 allows privileged physical attackers to access user da (CVSS 6.8)
- [CVE-2025-21071](https://cve.now/CVE-2025-21071.md): Out-of-bounds write in handling opcode in fingerprint trustlet prior to SMR Nov-2025 Release 1 allows local privileged attackers to write ou (CVSS 5.7)
- [CVE-2025-21050](https://cve.now/CVE-2025-21050.md): Improper input validiation in Contacts prior to SMR Oct-2025 Release 1 allows local attackers to access data across multiple user profiles. (CVSS 7.1)
- [CVE-2025-21070](https://cve.now/CVE-2025-21070.md): Out-of-bounds write in the SPI decoder in Samsung Notes prior to version 4.4.30.63 allows local attackers to write out-of-bounds memory. (CVSS 4.0)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/samsung-mobile
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.