Samsung Mobile vulnerabilities
Published CVEs affecting Samsung Mobile products: 237 record(s), with severity, exploitation and fixes.
Samsung Mobile Devices 144Smart Switch 19Samsung Notes 7Samsung Health 5Samsung Account 5Galaxy Store 4Samsung Internet 4Samsung Members 3Samsung Assistant 3Samsung Checkout 3Samsung Flow 3Galaxy Wearable 2Samsung Email 2Retail Mode 2Bixby 2Samsung Cloud Assistant 2MotionPhoto 2Libsavscmn.so 1Watch Plugin 1Visual Voicemail 1Bixby Touch 1Collection 1SmartThings 1SamsungPassAutofill 1My Galaxy 1Samsung Pass 1Samsung Tips 1InputSharing 1Libsthmbc 1Samsung Voice Recorder 1Routines 1SmartTouchCall 1Galaxy Store for Galaxy Watch 1Samsung Camera 1Samsung Plus TV 1Samsung Android USB Driver for Windows 1Samsung Auto 1Samsung Cloud 1GalaxyDiagnostics 1Samsung System Support Service 1
CVE-2026-21090
High · 7.8
CWE-787 Sep 9, 2026
Out-of-bounds Write in Samsung Android
Out-of-bounds write in libsaviextractor.so prior to SMR Sep-2026 Release 1 allows local attackers to write out-of-bounds memory.
CVE-2026-21089
High · 7.8
CWE-20 Sep 9, 2026
Improper Input Validation in Samsung Android
Improper input validation in removing style tag in libsubextractor.so prior to SMR Sep-2026 Release 1 allows local attackers to write out-of-bounds memory.
CVE-2026-21088
High · 7.8
CWE-20 Sep 9, 2026
Improper Input Validation in Samsung Android
Improper input validation in loading a subtitle frame in libsubextractor.so prior to SMR Sep-2026 Release 1 allows local attackers to write out-of-bounds memory.
CVE-2026-21087
High · 7.8
CWE-787 Sep 9, 2026
Out-of-bounds Write in Samsung Android
Out-of-bounds write in libmdnie.so prior to SMR Sep-2026 Release 1 allows local attackers to execute arbitrary code with system server privilege.
CVE-2026-21086
High · 7.8
CWE-20 Sep 9, 2026
Improper Input Validation in Samsung Android
Improper authorization in ProxyHandler prior to SMR Aug-2026 Release 1 allows local attackers to access proxy configuration.
CVE-2026-21085
Medium · 6.7
CWE-787 Sep 9, 2026
Out-of-bounds Write in Samsung Android
Out-of-bounds write in Keymaster trustlet prior to SMR Sep-2026 Release 1 allows local privileged attackers to write out-of-bounds memory.
CVE-2026-21084
Medium · 6.9
CWE-284 Aug 10, 2026
Improper Access Control in Samsung Mobile SmartThings
Improper access control in SmartThings prior to version 1.8.47.24 allows local attackers to access sensitive information.
CVE-2026-21083
Medium · 6.5
CWE-20 Aug 10, 2026
Improper Input Validation in Samsung Smart Switch
Improper input validation in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to access sensitive data.
CVE-2026-21082
Medium · 5.5
CWE-23 Aug 10, 2026
Relative Path Traversal in Samsung Health
Relative path traversal in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information.
CVE-2026-21081
Medium · 5.1
CWE-926 Aug 10, 2026
Improper export of android application components in SamsungPassAutofill prior to…
Improper export of android application components in SamsungPassAutofill prior to version 5.2.10.x allows local attackers to access sensitive information. User interaction is required for triggering this vulnerability.
CVE-2026-21080
Medium · 6.5
CWE-312 Aug 10, 2026
Cleartext Storage of Sensitive Information in Samsung Smart Switch
Cleartext storage of sensitive information in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to access sensitive data.
CVE-2026-21079
Medium · 6.5
CWE-311 Aug 10, 2026
Missing Encryption of Sensitive Data in Samsung Smart Switch
Missing encryption of sensitive data in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to intercept transmitted data.
CVE-2026-21078
Medium · 6.5
CWE-345 Aug 10, 2026
Insufficient Verification of Data Authenticity in Samsung Smart Switch
Insufficient verification of data authenticity in Smart Switch trouble scanning mode prior to version 3.7.72.6 allows adjacent attackers to spoof device identity.
CVE-2026-21077
Medium · 5.5
CWE-863 Aug 10, 2026
Incorrect Authorization in Samsung Health
Incorrect authorization in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information.
CVE-2026-21076
Medium · 5.5
CWE-863 Aug 10, 2026
Incorrect Authorization in Samsung Health
Incorrect authorization in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information.
CVE-2026-21075
Medium · 5.3
CWE-939 Aug 10, 2026
Improper authorization in handler for custom URL scheme in My Galaxy prior to version…
Improper authorization in handler for custom URL scheme in My Galaxy prior to version 6.3 allows remote attackers to access sensitive information.
CVE-2026-21074
High · 7.2
CWE-276 Aug 10, 2026
Incorrect Default Permissions in Samsung Mobile Bixby
Incorrect default permissions in Bixby prior to version 4.0.86.0 allows local attackers to execute arbitrary commands with Bixby privilege.
CVE-2026-21073
Medium · 6.1
Aug 10, 2026
Improper input validation in Galaxy Themes prior to SMR Aug-2026 Release 1 allows…
Improper input validation in Galaxy Themes prior to SMR Aug-2026 Release 1 allows physical attackers to launch arbitrary activity.
CVE-2026-21072
High · 7.8
CWE-20 Aug 10, 2026
Improper Input Validation in Samsung Android
Improper input validation in VC1 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory.
CVE-2026-21071
High · 7.8
CWE-20 Aug 10, 2026
Improper Input Validation in Samsung Android
Improper input validation in MPEG4 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory.
CVE-2026-21070
Medium · 4.6
CWE-20 Aug 10, 2026
Improper Input Validation in Samsung Android
Improper input validation in Samsung Message prior to SMR Aug-2026 Release 1 allows physical attackers to access sensitive information.
CVE-2026-21069
High · 7.8
CWE-681 Aug 10, 2026
Incorrect conversion between numeric types in VC1 codec in libsavsvc.so prior to SMR…
Incorrect conversion between numeric types in VC1 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory.
CVE-2026-21068
High · 7.8
CWE-121 Aug 10, 2026
Stack-based Buffer Overflow in Samsung Android
Stack-based buffer overflow in libril_sem.so prior to SMR Aug-2026 Release 1 allows privileged local attackers to execute arbitrary code.
CVE-2026-21067
High · 7.8
Aug 10, 2026
Improper input validation in libsmsd.so prior to SMR Aug-2026 Release 1 allows local…
Improper input validation in libsmsd.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory.
CVE-2026-21066
High · 7.8
CWE-20 Aug 10, 2026
Improper Input Validation in Samsung Android
Improper input validation in libcodec2_sec_flacdec.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory.