CVE-2026-21023

MediumCVSS 5.5/10Last modified Oct 26, 2026

Description

Insufficient verification of data authenticity in PackageManagerService prior to SMR Mar-2026 Release 1 allows local attackers to modify the installation restriction of specific application.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Affected software

Vendor	Product	Versions
Samsung Mobile	Samsung Mobile Devices	—

References

https://security.samsungmobile.com/securityUpdate.smsb?year=2026&month=03Vendor Advisory

Timeline

Published: Apr 29, 2026
Last modified: Oct 26, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-210246.3Improper privilege management in Samsung System Support Service prior to version 8.0.8.0 allows local attackers to trigger privileged functi CVE-2026-210255.5Incorrect privilege assignment in Telephony prior to SMR Jun-2026 Release 1 allows local attackers to access sensitive information.CVE-2026-210265.5Improper export of android application components in SpriteWallpaper prior to SMR Jun-2026 Release 1 allows local attackers to access to sen CVE-2026-210273.3Improper export of android application components in ImsSettings prior to SMR Jun-2026 Release 1 allows local attackers to trigger logging f CVE-2026-210285.5Improper access control in AuditLogService prior to SMR Jun-2026 Release 1 allows local attackers to access sensitive information.CVE-2026-210297.8Improper export of android application components in Galaxy Editing Service prior to SMR Jun-2026 Release 1 allows local attacker to execute CVE-2026-21037.8Infor SyteLine ERP uses hard-coded static cryptographic keys to encrypt stored credentials, including user passwords, database connection st CVE-2026-210307.8Improper access control in MediaTek Audio HAL prior to SMR Jun-2026 Release 1 allows local attackers to trigger privileged functions.CVE-2026-210317.8Improper authorization in AppBlock prior to SMR Jun-2026 Release 1 allows local attacker to launch arbitrary activity. User interaction is r CVE-2026-210327.1Improper export of android application components in SmartHomeWidgetReceiver of Samsung Assistant prior to version 9.3.14 allows local attac CVE-2026-210337.1Improper export of android application components in ExpressHomeWidgetReceiver of Samsung Assistant prior to version 9.3.14 allows local att CVE-2026-210343.3Improper export of android application components in Samsung Auto prior to version 3.1.2.61 in Android 15 and 3.2.0.38 in Android 16 allows