CVE-2026-21014

LowCVSS 2.8/10Last modified Oct 26, 2026

Description

Improper access control in Samsung Camera prior to version 16.5.00.28 allows local attacker to access location data. User interaction is required for triggering this vulnerability.

Metrics

CVSS 3.1 2.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

Affected software

VendorProductVersions
Samsung MobileSamsung Camera—

References

Timeline

Published
Apr 13, 2026
Last modified
Oct 26, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-210155.5Incorrect default permissions in FactoryCamera prior to SMR May-2026 Release 1 allows local attacker to access unique identifier.CVE-2026-210165.5Incorrect privilege assignment in LocationManager prior to SMR May-2026 Release 1 allows local attackers to access sensitive information.CVE-2026-210175.5Improper handling of insufficient privileges in SecTelephonyProvider prior to SMR Jun-2026 Release 1 allows local attackers to access privilCVE-2026-210186.7Out-of-bounds write in SveService prior to SMR May-2026 Release 1 allows local privileged attackers to execute arbitrary code.CVE-2026-210198.6Improper input validation in FacAtFunction in Galaxy Watch prior to SMR May-2026 Release 1 allows local attacker to execute arbitrary code wCVE-2026-21026.1wrensec-commons contains a reflected cross-site scripting (XSS) vulnerability in the CREST framework's HTTP binding. The HttpUtils.prepareReCVE-2026-210207.8Improper export of android application components in OmaCP prior to SMR May-2026 Release 1 allows local attackers to trigger privileged funcCVE-2026-210216.8Improper input validation in Routines prior to SMR May-2026 Release 1 allows physical attackers to launch privileged activity.CVE-2026-210225.5Improper handling of insufficient permissions in Routines prior to SMR May-2026 Release 1 allows local attackers to access sensitive informaCVE-2026-210235.5Insufficient verification of data authenticity in PackageManagerService prior to SMR Mar-2026 Release 1 allows local attackers to modify theCVE-2026-210246.3Improper privilege management in Samsung System Support Service prior to version 8.0.8.0 allows local attackers to trigger privileged functiCVE-2026-210255.5Incorrect privilege assignment in Telephony prior to SMR Jun-2026 Release 1 allows local attackers to access sensitive information.
CVE-2026-21014: Low severity, CVSS 2.8 | Vulnix