CVE-2026-21070

MediumCVSS 4.6/10Last modified Oct 23, 2026

Description

Improper input validation in Samsung Message prior to SMR Aug-2026 Release 1 allows physical attackers to access sensitive information.

Metrics

CVSS 3.1 4.6/10CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-20

Affected software

VendorProductVersions
Samsung MobileSamsung Mobile Devices—

References

Timeline

Published
Aug 10, 2026
Last modified
Oct 23, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-210717.8Improper input validation in MPEG4 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memorCVE-2026-210727.8Improper input validation in VC1 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory.CVE-2026-210736.1Improper input validation in Galaxy Themes prior to SMR Aug-2026 Release 1 allows physical attackers to launch arbitrary activity.CVE-2026-210747.2Incorrect default permissions in Bixby prior to version 4.0.86.0 allows local attackers to execute arbitrary commands with Bixby privilege.CVE-2026-210755.3Improper authorization in handler for custom URL scheme in My Galaxy prior to version 6.3 allows remote attackers to access sensitive informCVE-2026-210765.5Incorrect authorization in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information.CVE-2026-210775.5Incorrect authorization in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information.CVE-2026-210786.5Insufficient verification of data authenticity in Smart Switch trouble scanning mode prior to version 3.7.72.6 allows adjacent attackers to CVE-2026-210796.5Missing encryption of sensitive data in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to intercept transmitted data.CVE-2026-21087.5A vulnerability was determined in jsbroks COCO Annotator up to 0.11.1. This impacts an unknown function of the file /api/info/long_task of tCVE-2026-210806.5Cleartext storage of sensitive information in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to access sensitive data.CVE-2026-210815.1Improper export of android application components in SamsungPassAutofill prior to version 5.2.10.x allows local attackers to access sensitiv
CVE-2026-21070: Medium severity, CVSS 4.6 | Vulnix