CVE-2026-21018

MediumCVSS 6.7/10Last modified Jun 17, 2026

Description

Out-of-bounds write in SveService prior to SMR May-2026 Release 1 allows local privileged attackers to execute arbitrary code.

Metrics

CVSS 3.1 6.7/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

No affected versions have been published.

Timeline

Published
May 13, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-210198.6Improper input validation in FacAtFunction in Galaxy Watch prior to SMR May-2026 Release 1 allows local attacker to execute arbitrary code wCVE-2026-210207.8Improper export of android application components in OmaCP prior to SMR May-2026 Release 1 allows local attackers to trigger privileged funcCVE-2026-210216.8Improper input validation in Routines prior to SMR May-2026 Release 1 allows physical attackers to launch privileged activity.CVE-2026-210225.5Improper handling of insufficient permissions in Routines prior to SMR May-2026 Release 1 allows local attackers to access sensitive informaCVE-2026-210235.5Insufficient verification of data authenticity in PackageManagerService prior to SMR Mar-2026 Release 1 allows local attackers to modify theCVE-2026-210246.3Improper privilege management in Samsung System Support Service prior to version 8.0.8.0 allows local attackers to trigger privileged functiCVE-2026-210255.5Incorrect privilege assignment in Telephony prior to SMR Jun-2026 Release 1 allows local attackers to access sensitive information.CVE-2026-210265.5Improper export of android application components in SpriteWallpaper prior to SMR Jun-2026 Release 1 allows local attackers to access to senCVE-2026-210273.3Improper export of android application components in ImsSettings prior to SMR Jun-2026 Release 1 allows local attackers to trigger logging fCVE-2026-210285.5Improper access control in AuditLogService prior to SMR Jun-2026 Release 1 allows local attackers to access sensitive information.CVE-2026-210297.8Improper export of android application components in Galaxy Editing Service prior to SMR Jun-2026 Release 1 allows local attacker to executeCVE-2026-21037.8Infor SyteLine ERP uses hard-coded static cryptographic keys to encrypt stored credentials, including user passwords, database connection st