Samsung Mobile Devices (Samsung Mobile) - vulnerabilities (CVEs)

866 CVEs, 14 in the last 30 days, 4 known versions, newest CVE from 2026-10-12. Vendor: Samsung Mobile.

CVEs of Samsung Mobile Devices

• CVE-2026-21126 - CVSS 6.9 (medium), 2026-10-12: Improper input validation in getting cover image in libsimba.heifdec.media.samsung.so prior to SMR Oct-2026 Release 1 allows local attackers to write…
• CVE-2026-21125 - CVSS 8.6 (high), 2026-10-12: Improper input validation in parsing sheifd in libsimba.heifdec.media.samsung.so prior to SMR Oct-2026 Release 1 allows local attackers to potentially execute…
• CVE-2026-21124 - CVSS 8.6 (high), 2026-10-12: Improper input validation in getting cover image in libsimba.heifdec.media.samsung.so prior to SMR Oct-2026 Release 1 allows local attackers to potentially…
• CVE-2026-21123 - CVSS 6.7 (medium), 2026-10-12: Improper privilege management in Locksettings prior to SMR Oct-2026 Release 1 allows local privileged attackers with root privilege to access data of the tied…
• CVE-2026-21122 - CVSS 7 (high), 2026-10-12: Out-of-bounds write in libsamsungtts.so prior to SMR Oct-2026 Release 1 allows local attackers to execute arbitrary code.
• CVE-2026-21121 - CVSS 6.9 (medium), 2026-10-12: Improper handling of insufficient permission in CmcCore prior to SMR Oct-2026 Release 1 allows local attackers to use the privileged APIs.
• CVE-2026-21120 - CVSS 8.9 (high), 2026-10-12: Use after free in WSM service prior to SMR Oct-2026 Release 1 allows local attackers to potentially execute arbitrary code with system privilege.
• CVE-2026-21119 - CVSS 4.8 (medium), 2026-10-12: Out-of-bounds read and write in lib_sag_ai_sound_sep_v2.00.so prior to SMR Oct-2026 Release 1 allows local attackers to read and write out-of-bounds memory.
• CVE-2026-21118 - CVSS 6.9 (medium), 2026-10-12: Improper access control in DownloadProvider prior to SMR Oct-2026 Release 1 allows local attackers to access files in scoped storage.
• CVE-2026-21117 - CVSS 5.1 (medium), 2026-10-12: Improper access control in CocktailBarService prior to SMR Oct-2026 Release 1 allows local attackers to access sensitive information.
• CVE-2026-21116 - CVSS 5.1 (medium), 2026-10-12: Out-of-bounds write in libsmkvextractor.so prior to SMR Oct-2026 Release 1 allows local attackers to write out-of-bounds memory.
• CVE-2026-21115 - CVSS 5.1 (medium), 2026-10-12: Out-of-bounds write in libcodec2-sec-flacdec.so prior to SMR Oct-2026 Release 1 allows local attackers to write out-of-bounds memory.
• CVE-2026-21114 - CVSS 7 (high), 2026-10-12: Out-of-bounds write in libsmkvextractor.so prior to SMR Oct-2026 Release 1 allows local attackers to execute arbitrary code.
• CVE-2026-21140 - CVSS 6.9 (medium), 2026-10-02: Improper access control in ManagedProvisioning prior to SMR Sep-2026 Release 1 allows local attackers to install arbitrary applications.
• CVE-2026-21104 - CVSS 7.1 (high), 2026-09-09: Heap-based buffer overflow in KnoxVault trustlet prior to SMR Sep-2026 Release 1 allows local privileged attackers to execute arbitrary code.
• CVE-2026-21103 - CVSS 6.8 (medium), 2026-09-09: Path traversal in GalaxyDiagnostics prior to SMR Sep-2026 Release 1 allows physical attackers to access files with system privilege.
• CVE-2026-21102 - CVSS 9.3 (critical), 2026-09-09: Use after free in DualDAR prior to SMR Sep-2026 Release 1 allows local privileged attackers to execute arbitrary code with root privilege.
• CVE-2026-21101 - CVSS 8.4 (high), 2026-09-09: Improper input validation in DualDAR driver prior to SMR Sep-2026 Release 1 allows local privileged attackers to potentially execute arbitrary code with root…
• CVE-2026-21100 - CVSS 7.1 (high), 2026-09-09: Improper access control in SystemUI prior to SMR Sep-2026 Release 1 allows local attackers to launch arbitrary activity.
• CVE-2026-21099 - CVSS 5.5 (medium), 2026-09-09: Improper access control in SettingsProvider prior to SMR Sep-2026 Release 1 allows local attackers to access sensitive information.
• CVE-2026-21098 - CVSS 6.9 (medium), 2026-09-09: Improper access control in Link to Windows prior to SMR Sep-2026 Release 1 allows local attackers to establish a connection with the PC without proper user…
• CVE-2026-21097 - CVSS 6.7 (medium), 2026-09-09: Improper authentication in ActivityTaskManagerService prior to SMR Sep-2026 Release 1 allows local privileged attackers to launch arbitrary activity.
• CVE-2026-21096 - CVSS 9.8 (critical), 2026-09-09: Heap-based buffer overflow in JPEG decoder of libimagecodec.quram.so prior to SMR Sep-2026 Release 1 allows remote attackers to execute arbitrary code.
• CVE-2026-21095 - CVSS 9.8 (critical), 2026-09-09: Heap-based buffer overflow in DNG decoder of libimagecodec.quram.so prior to SMR Sep-2026 Release 1 allows remote attackers to execute arbitrary code.
• CVE-2026-21094 - CVSS 8.8 (high), 2026-09-09: Improper input validation in wpa_supplicant prior to SMR Sep-2026 Release 1 allows adjacent attackers to write out-of-bounds memory.
• CVE-2026-21093 - CVSS 6.7 (medium), 2026-09-09: Stack-based buffer overflow in PROCA trustlet prior to SMR Sep-2026 Release 1 allows local privileged attackers to write out-of-bounds memory.
• CVE-2026-21092 - CVSS 8.8 (high), 2026-09-09: Path traversal in ImsService prior to SMR Sep-2026 Release 1 allows remote attackers to create image files with system server privilege.
• CVE-2026-21091 - CVSS 7.8 (high), 2026-09-09: Out-of-bounds write in libcodec2secevrcdec.so prior to SMR Sep-2026 Release 1 allows local attackers to write out-of-bounds memory.
• CVE-2026-21090 - CVSS 7.8 (high), 2026-09-09: Out-of-bounds write in libsaviextractor.so prior to SMR Sep-2026 Release 1 allows local attackers to write out-of-bounds memory.
• CVE-2026-21089 - CVSS 7.8 (high), 2026-09-09: Improper input validation in removing style tag in libsubextractor.so prior to SMR Sep-2026 Release 1 allows local attackers to write out-of-bounds memory.
• CVE-2026-21088 - CVSS 7.8 (high), 2026-09-09: Improper input validation in loading a subtitle frame in libsubextractor.so prior to SMR Sep-2026 Release 1 allows local attackers to write out-of-bounds…
• CVE-2026-21087 - CVSS 8.6 (high), 2026-09-09: Out-of-bounds write in libmdnie.so prior to SMR Sep-2026 Release 1 allows local attackers to execute arbitrary code with system server privilege.
• CVE-2026-21086 - CVSS 7.8 (high), 2026-09-09: Improper authorization in ProxyHandler prior to SMR Aug-2026 Release 1 allows local attackers to access proxy configuration.
• CVE-2026-21085 - CVSS 8.4 (high), 2026-09-09: Out-of-bounds write in Keymaster trustlet prior to SMR Sep-2026 Release 1 allows local privileged attackers to write out-of-bounds memory.
• CVE-2026-21073 - CVSS 6.1 (medium), 2026-08-10: Improper input validation in Galaxy Themes prior to SMR Aug-2026 Release 1 allows physical attackers to launch arbitrary activity.
• CVE-2026-21072 - CVSS 7.8 (high), 2026-08-10: Improper input validation in VC1 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory.
• CVE-2026-21071 - CVSS 7.8 (high), 2026-08-10: Improper input validation in MPEG4 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory.
• CVE-2026-21070 - CVSS 5.1 (medium), 2026-08-10: Improper input validation in Samsung Message prior to SMR Aug-2026 Release 1 allows physical attackers to access sensitive information.
• CVE-2026-21069 - CVSS 7.8 (high), 2026-08-10: Incorrect conversion between numeric types in VC1 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory.
• CVE-2026-21068 - CVSS 8.4 (high), 2026-08-10: Stack-based buffer overflow in libril_sem.so prior to SMR Aug-2026 Release 1 allows privileged local attackers to execute arbitrary code.
• CVE-2026-21067 - CVSS 7.8 (high), 2026-08-10: Improper input validation in libsmsd.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory.
• CVE-2026-21066 - CVSS 7.8 (high), 2026-08-10: Improper input validation in libcodec2_sec_flacdec.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory.
• CVE-2026-21065 - CVSS 7.8 (high), 2026-08-10: Out-of-bounds write in libcodec2secqcelpdec.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory.
• CVE-2026-21064 - CVSS 7 (high), 2026-08-10: Improper access control in Weaver prior to SMR Aug-2026 Release 1 allows local attackers to cause device inoperability.
• CVE-2026-21063 - CVSS 6.8 (medium), 2026-08-10: Improper export of android application components in AppLock prior to SMR Aug-2026 Release 1 allows physical attackers to bypass app lock function.
• CVE-2026-21062 - CVSS 4.8 (medium), 2026-08-10: Authorization bypass in SemClipboardService prior to SMR Aug-2026 Release 1 allows local attackers to access clipboard data.
• CVE-2026-21061 - CVSS 6.5 (medium), 2026-08-10: Improper input validation in Samsung Dialer prior to SMR Aug-2026 Release 1 allows remote attackers to access SIM related functions. User interaction is…
• CVE-2026-21060 - CVSS 6.7 (medium), 2026-08-10: Improper input validation in Samsung Contacts prior to SMR Aug-2026 Release 1 allows physical attackers to access data across multiple user profiles.
• CVE-2026-21059 - CVSS 7.1 (high), 2026-08-10: Improper export of android application components in Samsung Contacts prior to SMR Aug-2026 Release 1 allows local attackers to delete file with Samsung…
• CVE-2026-21058 - CVSS 7.1 (high), 2026-08-10: Improper input validation in Samsung Contacts prior to SMR Aug-2026 Release 1 allows local attackers to delete file with Samsung Contacts' privilege.
• CVE-2026-21047 - CVSS 8.3 (high), 2026-07-28: Out-of-bounds write in ImsService prior to SMR Jul-2026 Release 1 allows remote attackers to potentially execute arbitrary code.
• CVE-2026-21052 - CVSS 6.8 (medium), 2026-07-10: Path traversal in SemClipboardService prior to SMR Jul-2026 Release 1 allows local privileged attackers to access files with system privilege.
• CVE-2026-21051 - CVSS 5.1 (medium), 2026-07-10: Incorrect default permissions in WLAN security prior to SMR Jul-2026 Release 1 allows local attackers to configure TencentWifiSecurity settings.
• CVE-2026-21050 - CVSS 5.1 (medium), 2026-07-10: Improper access control in SmartThingsKit prior to SMR Jul-2026 Release 1 allows local attackers to access sensitive information.
• CVE-2026-21049 - CVSS 8.4 (high), 2026-07-10: Out-of-bounds write in libpadm.so library prior to SMR Jul-2026 Release 1 allows local attackers to execute arbitrary code.
• CVE-2026-21048 - CVSS 8.4 (high), 2026-07-10: Out-of-bounds write in parsing DNG format in libimagecodec.media.quram.so prior to SMR Jul-2026 Release 1 allows remote attackers to write out-of-bounds memory.
• CVE-2026-21046 - CVSS 8.4 (high), 2026-07-10: Time-of-check time-of-use race condition in fabricKeymaster trustlet prior to SMR Jul-2026 Release 1 allows local privileged attackers to execute arbitrary…
• CVE-2026-21045 - CVSS 8.4 (high), 2026-07-10: Out-of-bounds write in parsing TIFF format in libimagecodec.media.quram.so prior to SMR Jul-2026 Release 1 allows remote attackers to write out-of-bounds…
• CVE-2026-21044 - CVSS 5.8 (medium), 2026-07-10: Improper authorization in KnoxGuardManager prior to SMR Jul-2026 Release 1 allows local attackers to bypass the persistence configuration of the application.
• CVE-2026-21043 - CVSS 6.7 (medium), 2026-07-10: Path traversal in Wallpaper service prior to SMR Jul-2026 Release 1 allows local privileged attackers to access files with system server privilege.
• CVE-2026-21042 - CVSS 8.7 (high), 2026-07-10: Out-of-bounds write in libsavsac.so prior to SMR Jul-2026 Release 1 allows remote attackers to execute arbitrary code.
• CVE-2026-21041 - CVSS 6.9 (medium), 2026-07-10: Improper access control in SamsungSEAgentService prior to SMR Jul-2026 Release 1 allows local attackers to access sensitive information.
• CVE-2026-21040 - CVSS 6.9 (medium), 2026-07-10: Improper access control in IAFDService prior to SMR Jul-2026 Release 1 allows local privileged attackers to use the privileged APIs.
• CVE-2026-21039 - CVSS 6.9 (medium), 2026-07-10: Improper access control in Settings prior to SMR Jul-2026 Release 1 allows local attackers to configure Theft protection settings.
• CVE-2026-21031 - CVSS 7.8 (high), 2026-06-05: Improper authorization in AppBlock prior to SMR Jun-2026 Release 1 allows local attacker to launch arbitrary activity. User interaction is required for…
• CVE-2026-21027 - CVSS 4.8 (medium), 2026-06-05: Improper export of android application components in ImsSettings prior to SMR Jun-2026 Release 1 allows local attackers to trigger logging function.
• CVE-2026-21030 - CVSS 7.8 (high), 2026-06-05: Improper access control in MediaTek Audio HAL prior to SMR Jun-2026 Release 1 allows local attackers to trigger privileged functions.
• CVE-2026-21026 - CVSS 6.4 (medium), 2026-06-05: Improper export of android application components in SpriteWallpaper prior to SMR Jun-2026 Release 1 allows local attackers to access to sensitive information.
• CVE-2026-21029 - CVSS 7.8 (high), 2026-06-05: Improper export of android application components in Galaxy Editing Service prior to SMR Jun-2026 Release 1 allows local attacker to execute privileged…
• CVE-2026-21028 - CVSS 5.5 (medium), 2026-06-05: Improper access control in AuditLogService prior to SMR Jun-2026 Release 1 allows local attackers to access sensitive information.
• CVE-2026-21017 - CVSS 5.5 (medium), 2026-06-05: Improper handling of insufficient privileges in SecTelephonyProvider prior to SMR Jun-2026 Release 1 allows local attackers to access privileged files.
• CVE-2026-21025 - CVSS 6.9 (medium), 2026-06-05: Incorrect privilege assignment in Telephony prior to SMR Jun-2026 Release 1 allows local attackers to access sensitive information.
• CVE-2026-21016 - CVSS 5.5 (medium), 2026-05-13: Incorrect privilege assignment in LocationManager prior to SMR May-2026 Release 1 allows local attackers to access sensitive information.
• CVE-2026-21020 - CVSS 7.8 (high), 2026-05-13: Improper export of android application components in OmaCP prior to SMR May-2026 Release 1 allows local attackers to trigger privileged functions.
• CVE-2026-21019 - CVSS 8.9 (high), 2026-05-13: Improper input validation in FacAtFunction in Galaxy Watch prior to SMR May-2026 Release 1 allows local attacker to execute arbitrary code with system…
• CVE-2026-21022 - CVSS 6.9 (medium), 2026-05-13: Improper handling of insufficient permissions in Routines prior to SMR May-2026 Release 1 allows local attackers to access sensitive information.
• CVE-2026-21018 - CVSS 6.8 (medium), 2026-05-13: Out-of-bounds write in SveService prior to SMR May-2026 Release 1 allows local privileged attackers to execute arbitrary code.
• CVE-2026-21021 - CVSS 6.8 (medium), 2026-05-13: Improper input validation in Routines prior to SMR May-2026 Release 1 allows physical attackers to launch privileged activity.
• CVE-2026-21015 - CVSS 6.8 (medium), 2026-05-13: Incorrect default permissions in FactoryCamera prior to SMR May-2026 Release 1 allows local attacker to access unique identifier.
• CVE-2026-21023 - CVSS 6.9 (medium), 2026-04-29: Insufficient verification of data authenticity in PackageManagerService prior to SMR Mar-2026 Release 1 allows local attackers to modify the installation…
• CVE-2026-21012 - CVSS 6.8 (medium), 2026-04-13: External control of file name in AODManager prior to SMR Apr-2026 Release 1 allows privileged local attacker to create file with system privilege.
• CVE-2026-21008 - CVSS 6.5 (medium), 2026-04-13: Exposure of sensitive information in S Share prior to SMR Apr-2026 Release 1 allows adjacent attacker to access sensitive information.
• CVE-2026-21011 - CVSS 6.8 (medium), 2026-04-13: Incorrect privilege assignment in Bluetooth in Maintenance mode prior to SMR Apr-2026 Release 1 allows physical attackers to bypass Extend Unlock.
• CVE-2026-21007 - CVSS 6.8 (medium), 2026-04-13: Improper check for exceptional conditions in Device Care prior to SMR Apr-2026 Release 1 allows physical attackers to bypass Knox Guard.
• CVE-2026-21010 - CVSS 7.8 (high), 2026-04-13: Improper input validation in Retail Mode prior to SMR Apr-2026 Release 1 allows local attackers to trigger privileged functions.
• CVE-2026-21006 - CVSS 4.7 (medium), 2026-04-13: Improper access control in Samsung DeX prior to SMR Apr-2026 Release 1 allows physical attackers to access to hidden notification contents.
• CVE-2026-21009 - CVSS 6.8 (medium), 2026-04-13: Improper check for exceptional conditions in Recents prior to SMR Apr-2026 Release 1 allows physical attacker to bypass App Pinning.
• CVE-2026-21003 - CVSS 6.8 (medium), 2026-04-13: Improper input validation in data related to network restrictions prior to SMR Apr-2026 Release 1 allows physical attackers to bypass the restrictions.
• CVE-2026-20992 - CVSS 4.8 (medium), 2026-03-16: Improper authorization in Settings prior to SMR Mar-2026 Release 1 allows local attacker to disable configuring the background data usage of application.
• CVE-2026-20990 - CVSS 8.4 (high), 2026-03-16: Improper export of android application components in Secure Folder prior to SMR Mar-2026 Release 1 allows local attackers to launch arbitrary activity with…
• CVE-2026-20989 - CVSS 5.1 (medium), 2026-03-16: Improper verification of cryptographic signature in Font Settings prior to SMR Mar-2026 Release 1 allows physical attackers to use custom font.
• CVE-2026-20988 - CVSS 6.8 (medium), 2026-03-16: Improper verification of intent by broadcast receiver in Settings prior to SMR Mar-2026 Release 1 allows local attacker to launch arbitrary activity with…
• CVE-2026-20991 - CVSS 6.7 (medium), 2026-03-16: Improper privilege management in ThemeManager prior to SMR Mar-2026 Release 1 allows local privileged attackers to reuse trial contents.
• CVE-2026-20983 - CVSS 8.4 (high), 2026-02-04: Improper export of android application components in Samsung Dialer prior to SMR Feb-2026 Release 1 allows local attackers to launch arbitrary activity with…
• CVE-2026-20982 - CVSS 6.8 (medium), 2026-02-04: Path traversal in ShortcutService prior to SMR Feb-2026 Release 1 allows privileged local attacker to create file with system privilege.
• CVE-2026-20981 - CVSS 6.6 (medium), 2026-02-04: Improper input validation in FacAtFunction prior to SMR Feb-2026 Release 1 allows privileged physical attacker to execute arbitrary command with system…
• CVE-2026-20980 - CVSS 7 (high), 2026-02-04: Improper input validation in PACM prior to SMR Feb-2026 Release 1 allows physical attacker to execute arbitrary commands.
• CVE-2026-20979 - CVSS 8.4 (high), 2026-02-04: Improper privilege management in Settings prior to SMR Feb-2026 Release 1 allows local attackers to launch arbitrary activity with Settings privilege.
• CVE-2026-20978 - CVSS 6.1 (medium), 2026-02-04: Improper authorization in KnoxGuardManager prior to SMR Feb-2026 Release 1 allows local attackers to bypass the persistence configuration of the application.
• CVE-2026-20977 - CVSS 6.9 (medium), 2026-02-04: Improper access control in Emergency Sharing prior to SMR Feb-2026 Release 1 allows local attackers to interrupt its functioning.