CVE-2026-21121
6.9MediumPublished 12 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on confidentiality
- Weakness
- CWE-280
Impact
Local attackers can access privileged APIs and read sensitive data on the device without requiring prior permissions or user interaction.
Root cause
CmcCore improperly handles insufficient permission checks, allowing unauthorized callers access to restricted functions.
Affected systems
Samsung CmcCore prior to SMR Oct-2026 Release 1.
CVSS v4.0 · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Fix & remediation
Update Samsung mobile devices to the SMR Oct-2026 Release 1 security patch or later. No interim mitigations are available for local API access.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Improper handling of insufficient permission in CmcCore prior to SMR Oct-2026 Release 1 allows local attackers to use the privileged APIs.