Samsung Mobile vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-21157 Improper input validation in Bixby prior to version 4.0.85.6 allows privileged local attackers to launch arbitrary activity.High 8.3 · Oct 28, 2026
• CVE-2026-21139 Improper access control in Samsung Continuity Service for windows prior to version 4.6.1217.0 allows adjacent attackers to manipulate the connected mobile devicHigh 7.3 · Oct 12, 2026
• CVE-2026-21125 Improper input validation in parsing sheifd in libsimba.heifdec.media.samsung.so prior to SMR Oct-2026 Release 1 allows local attackers to potentially execute aHigh 8.6 · Oct 12, 2026
• CVE-2026-21124 Improper input validation in getting cover image in libsimba.heifdec.media.samsung.so prior to SMR Oct-2026 Release 1 allows local attackers to potentially execHigh 8.6 · Oct 12, 2026
• CVE-2026-21122 Out-of-bounds write in libsamsungtts.so prior to SMR Oct-2026 Release 1 allows local attackers to execute arbitrary code.High 7 · Oct 12, 2026
• CVE-2026-21120 Use after free in WSM service prior to SMR Oct-2026 Release 1 allows local attackers to potentially execute arbitrary code with system privilege.High 8.9 · Oct 12, 2026
• CVE-2026-21114 Out-of-bounds write in libsmkvextractor.so prior to SMR Oct-2026 Release 1 allows local attackers to execute arbitrary code.High 7 · Oct 12, 2026
• CVE-2026-21104 Heap-based buffer overflow in KnoxVault trustlet prior to SMR Sep-2026 Release 1 allows local privileged attackers to execute arbitrary code.High 7.1 · Sep 9, 2026
• CVE-2026-21102 Use after free in DualDAR prior to SMR Sep-2026 Release 1 allows local privileged attackers to execute arbitrary code with root privilege.Critical 9.3 · Sep 9, 2026
• CVE-2026-21101 Improper input validation in DualDAR driver prior to SMR Sep-2026 Release 1 allows local privileged attackers to potentially execute arbitrary code with root prHigh 8.4 · Sep 9, 2026
• CVE-2026-21096 Heap-based buffer overflow in JPEG decoder of libimagecodec.quram.so prior to SMR Sep-2026 Release 1 allows remote attackers to execute arbitrary code.Critical 9.2 · Sep 9, 2026
• CVE-2026-21095 Heap-based buffer overflow in DNG decoder of libimagecodec.quram.so prior to SMR Sep-2026 Release 1 allows remote attackers to execute arbitrary code.Critical 9.2 · Sep 9, 2026
• CVE-2026-21092 Path traversal in ImsService prior to SMR Sep-2026 Release 1 allows remote attackers to create image files with system server privilege.High 8.8 · Sep 9, 2026
• CVE-2026-21087 Out-of-bounds write in libmdnie.so prior to SMR Sep-2026 Release 1 allows local attackers to execute arbitrary code with system server privilege.High 8.6 · Sep 9, 2026
• CVE-2026-21085 Out-of-bounds write in Keymaster trustlet prior to SMR Sep-2026 Release 1 allows local privileged attackers to write out-of-bounds memory.High 8.4 · Sep 9, 2026
• CVE-2026-21079 Missing encryption of sensitive data in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to intercept transmitted data.High 7 · Aug 10, 2026
• CVE-2026-21074 Incorrect default permissions in Bixby prior to version 4.0.86.0 allows local attackers to execute arbitrary commands with Bixby privilege.High 7.2 · Aug 10, 2026
• CVE-2026-21068 Stack-based buffer overflow in libril_sem.so prior to SMR Aug-2026 Release 1 allows privileged local attackers to execute arbitrary code.High 8.4 · Aug 10, 2026
• CVE-2026-21064 Improper access control in Weaver prior to SMR Aug-2026 Release 1 allows local attackers to cause device inoperability.High 7 · Aug 10, 2026
• CVE-2026-21047 Out-of-bounds write in ImsService prior to SMR Jul-2026 Release 1 allows remote attackers to potentially execute arbitrary code.High 8.3 · Jul 28, 2026
• CVE-2026-21055 Improper export of android application components in Bixby prior to version 4.0.70.8 allows local attackers to execute arbitrary commands with Bixby privilege.High 8.5 · Jul 10, 2026
• CVE-2026-21049 Out-of-bounds write in libpadm.so library prior to SMR Jul-2026 Release 1 allows local attackers to execute arbitrary code.High 8.4 · Jul 10, 2026
• CVE-2026-21048 Out-of-bounds write in parsing DNG format in libimagecodec.media.quram.so prior to SMR Jul-2026 Release 1 allows remote attackers to write out-of-bounds memory.High 8.3 · Jul 10, 2026
• CVE-2026-21046 Time-of-check time-of-use race condition in fabricKeymaster trustlet prior to SMR Jul-2026 Release 1 allows local privileged attackers to execute arbitrary codeHigh 8.4 · Jul 10, 2026
• CVE-2026-21045 Out-of-bounds write in parsing TIFF format in libimagecodec.media.quram.so prior to SMR Jul-2026 Release 1 allows remote attackers to write out-of-bounds memoryHigh 8.3 · Jul 10, 2026