CVE-2026-21117
5.1MediumPublished 12 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-284
Impact
Local attackers can access sensitive device information without requiring privileges. They need local code execution on the device first.
Root cause
Improper access control in CocktailBarService exposes sensitive data to unauthorized local callers.
Affected systems
Samsung CocktailBarService prior to SMR Oct-2026 Release 1
CVSS v4.0 · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Fix & remediation
Apply Samsung Security Maintenance Release (SMR) Oct-2026 Release 1 or later. No interim workaround is documented.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Improper access control in CocktailBarService prior to SMR Oct-2026 Release 1 allows local attackers to access sensitive information.