CVE-2026-21126
6.9MediumPublished 12 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on integrity
- Weakness
- —
Impact
Local attackers can perform an out-of-bounds memory write to compromise the integrity of the process. They need local access on the device to exploit it.
Root cause
Improper input validation when extracting cover images in libsimba.heifdec.media.samsung.so enables out-of-bounds memory writes.
Affected systems
Samsung devices with libsimba.heifdec.media.samsung.so prior to SMR Oct-2026 Release 1.
CVSS v4.0 · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Fix & remediation
Upgrade device firmware to Samsung Maintenance Release Oct-2026 Release 1 or later. No standalone interim mitigation is provided.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Improper input validation in getting cover image in libsimba.heifdec.media.samsung.so prior to SMR Oct-2026 Release 1 allows local attackers to write out-of-bounds memory.