Samsung Mobile vulnerabilities
Published CVEs affecting Samsung Mobile products: 237 record(s), with severity, exploitation and fixes.
Samsung Mobile Devices 144Smart Switch 19Samsung Notes 7Samsung Health 5Samsung Account 5Galaxy Store 4Samsung Internet 4Samsung Members 3Samsung Assistant 3Samsung Checkout 3Samsung Flow 3Galaxy Wearable 2Samsung Email 2Retail Mode 2Bixby 2Samsung Cloud Assistant 2MotionPhoto 2Libsavscmn.so 1Watch Plugin 1Visual Voicemail 1Bixby Touch 1Collection 1SmartThings 1SamsungPassAutofill 1My Galaxy 1Samsung Pass 1Samsung Tips 1InputSharing 1Libsthmbc 1Samsung Voice Recorder 1Routines 1SmartTouchCall 1Galaxy Store for Galaxy Watch 1Samsung Camera 1Samsung Plus TV 1Samsung Android USB Driver for Windows 1Samsung Auto 1Samsung Cloud 1GalaxyDiagnostics 1Samsung System Support Service 1
CVE-2026-21040
Medium · 6.9
Jul 10, 2026
Improper access control in IAFDService prior to SMR Jul-2026 Release 1 allows local…
Improper access control in IAFDService prior to SMR Jul-2026 Release 1 allows local privileged attackers to use the privileged APIs.
CVE-2026-21039
Medium · 6.9
Jul 10, 2026
Improper access control in Settings prior to SMR Jul-2026 Release 1 allows local…
Improper access control in Settings prior to SMR Jul-2026 Release 1 allows local attackers to configure Theft protection settings.
CVE-2026-21038
Medium · 5.5
CWE-125 Jun 5, 2026
Out-of-bounds Read in Samsung Android Usb Driver
Improper input validation in Samsung Android USB Driver for Windows prior to version 1.9.5.0 allows local attacker to access out-of-bounds memory.
CVE-2026-21037
High · 7.1
Jun 5, 2026
Improper input validation in Samsung Members prior to version 5.8.01.5 allows local…
Improper input validation in Samsung Members prior to version 5.8.01.5 allows local attackers to access arbitrary URL and launch arbitrary activity with Samsung Members privilege.
CVE-2026-21036
Medium · 5.5
CWE-863 Jun 5, 2026
Incorrect Authorization in Samsung Internet
Improper authorization in Samsung Internet prior to version 30.0.0.39 allows local attackers to access sensitive information.
CVE-2026-21035
High · 7.5
Jun 5, 2026
Improper input validation in Samsung Plus TV prior to version 1.0.28.6 allows remote…
Improper input validation in Samsung Plus TV prior to version 1.0.28.6 allows remote attackers to access sensitive information.
CVE-2026-21034
Low · 3.3
Jun 5, 2026
Improper export of android application components in Samsung Auto prior to version…
Improper export of android application components in Samsung Auto prior to version 3.1.2.61 in Android 15 and 3.2.0.38 in Android 16 allows local attacker to change audio configuration.
CVE-2026-21033
High · 7.1
Jun 5, 2026
Improper export of android application components in ExpressHomeWidgetReceiver of…
Improper export of android application components in ExpressHomeWidgetReceiver of Samsung Assistant prior to version 9.3.14 allows local attacker to execute arbitrary script.
CVE-2026-21032
High · 7.1
Jun 5, 2026
Improper export of android application components in SmartHomeWidgetReceiver of Samsung…
Improper export of android application components in SmartHomeWidgetReceiver of Samsung Assistant prior to version 9.3.14 allows local attacker to execute arbitrary script.
CVE-2026-21031
High · 7.8
CWE-863 Jun 5, 2026
Incorrect Authorization in Samsung Android
Improper authorization in AppBlock prior to SMR Jun-2026 Release 1 allows local attacker to launch arbitrary activity. User interaction is required for triggering this vulnerability.
CVE-2026-21030
High · 7.8
Jun 5, 2026
Improper access control in MediaTek Audio HAL prior to SMR Jun-2026 Release 1 allows…
Improper access control in MediaTek Audio HAL prior to SMR Jun-2026 Release 1 allows local attackers to trigger privileged functions.
CVE-2026-21029
High · 7.8
Jun 5, 2026
Improper export of android application components in Galaxy Editing Service prior to SMR…
Improper export of android application components in Galaxy Editing Service prior to SMR Jun-2026 Release 1 allows local attacker to execute privileged operations.
CVE-2026-21028
Medium · 5.5
Jun 5, 2026
Improper access control in AuditLogService prior to SMR Jun-2026 Release 1 allows local…
Improper access control in AuditLogService prior to SMR Jun-2026 Release 1 allows local attackers to access sensitive information.
CVE-2026-21027
Low · 3.3
Jun 5, 2026
Improper export of android application components in ImsSettings prior to SMR Jun-2026…
Improper export of android application components in ImsSettings prior to SMR Jun-2026 Release 1 allows local attackers to trigger logging function.
CVE-2026-21026
Medium · 5.5
Jun 5, 2026
Improper export of android application components in SpriteWallpaper prior to SMR…
Improper export of android application components in SpriteWallpaper prior to SMR Jun-2026 Release 1 allows local attackers to access to sensitive information.
CVE-2026-21025
Medium · 5.5
Jun 5, 2026
Incorrect privilege assignment in Telephony prior to SMR Jun-2026 Release 1 allows local…
Incorrect privilege assignment in Telephony prior to SMR Jun-2026 Release 1 allows local attackers to access sensitive information.
CVE-2026-21017
Medium · 5.5
Jun 5, 2026
Improper handling of insufficient privileges in SecTelephonyProvider prior to SMR…
Improper handling of insufficient privileges in SecTelephonyProvider prior to SMR Jun-2026 Release 1 allows local attackers to access privileged files.
CVE-2026-21024
Medium · 6.3
May 13, 2026
Improper privilege management in Samsung System Support Service prior to version 8.0.8.0…
Improper privilege management in Samsung System Support Service prior to version 8.0.8.0 allows local attackers to trigger privileged functions.
CVE-2026-21022
Medium · 5.5
May 13, 2026
Improper handling of insufficient permissions in Routines prior to SMR May-2026 Release…
Improper handling of insufficient permissions in Routines prior to SMR May-2026 Release 1 allows local attackers to access sensitive information.
CVE-2026-21021
Medium · 6.8
May 13, 2026
Improper input validation in Routines prior to SMR May-2026 Release 1 allows physical…
Improper input validation in Routines prior to SMR May-2026 Release 1 allows physical attackers to launch privileged activity.
CVE-2026-21020
High · 7.8
May 13, 2026
Improper export of android application components in OmaCP prior to SMR May-2026 Release…
Improper export of android application components in OmaCP prior to SMR May-2026 Release 1 allows local attackers to trigger privileged functions.
CVE-2026-21019
High · 8.6
May 13, 2026
Improper input validation in FacAtFunction in Galaxy Watch prior to SMR May-2026 Release…
Improper input validation in FacAtFunction in Galaxy Watch prior to SMR May-2026 Release 1 allows local attacker to execute arbitrary code with system privilege.
CVE-2026-21018
Medium · 6.7
CWE-787 May 13, 2026
Out-of-bounds Write in Samsung Android
Out-of-bounds write in SveService prior to SMR May-2026 Release 1 allows local privileged attackers to execute arbitrary code.
CVE-2026-21016
Medium · 5.5
May 13, 2026
Incorrect privilege assignment in LocationManager prior to SMR May-2026 Release 1 allows…
Incorrect privilege assignment in LocationManager prior to SMR May-2026 Release 1 allows local attackers to access sensitive information.
CVE-2026-21015
Medium · 5.5
CWE-276 May 13, 2026
Incorrect Default Permissions in Samsung Android
Incorrect default permissions in FactoryCamera prior to SMR May-2026 Release 1 allows local attacker to access unique identifier.