CVE-2026-21123
6.7MediumPublished 12 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
- Impact
- High impact on confidentiality
- Weakness
- CWE-269
Impact
A local attacker with existing root access can read tied profile data before the device's first unlock. They must already have local execution with root privileges on the device.
Root cause
Improper privilege management in Locksettings allows root processes to bypass profile data isolation before the first unlock.
Affected systems
Samsung mobile devices running firmware prior to SMR Oct-2026 Release 1.
CVSS v4.0 · CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Fix & remediation
Upgrade device firmware to Samsung Security Maintenance Release (SMR) Oct-2026 Release 1 or later. There is no interim mitigation for compromised root environments prior to patching.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Improper privilege management in Locksettings prior to SMR Oct-2026 Release 1 allows local privileged attackers with root privilege to access data of the tied profile in before first unlock.